EP2704354A1 - Re-encryption key generator, re-encryption device, and program - Google Patents
Re-encryption key generator, re-encryption device, and program Download PDFInfo
- Publication number
- EP2704354A1 EP2704354A1 EP12776090.8A EP12776090A EP2704354A1 EP 2704354 A1 EP2704354 A1 EP 2704354A1 EP 12776090 A EP12776090 A EP 12776090A EP 2704354 A1 EP2704354 A1 EP 2704354A1
- Authority
- EP
- European Patent Office
- Prior art keywords
- key
- encryption
- encryption key
- public key
- private key
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/14—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using a plurality of keys or algorithms
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/30—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
- H04L9/3066—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy involving algebraic varieties, e.g. elliptic or hyper-elliptic curves
- H04L9/3073—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy involving algebraic varieties, e.g. elliptic or hyper-elliptic curves involving pairings, e.g. identity based encryption [IBE], bilinear mappings or bilinear pairings, e.g. Weil or Tate pairing
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
Definitions
- Embodiments described herein relate generally to a re-encryption key generator, re-encryption apparatus, and program.
- each user has a pair of a private key and public key, which are different for each user.
- the user A encrypts a file by means of a public key of the user B, and uploads the encrypted file onto the server.
- the public key of the user B is an individual encryption key for the user B.
- the user A encrypts a file by means of a public key of the user C, and uploads the encrypted file onto the server.
- the public key of the user C is an individual encryption key for the user C. That is, the user A encrypts a file individually for the users who share that file.
- each user shares a pair of a private key and public key, which are common to the respective users.
- the user A encrypts a file by means of a public key (as an encryption key common to the respective users), and uploads the encrypted file onto the server.
- the respective users share an identical private key.
- each user has a pair of a private key and public key, which are different for respective users like in the individual key system (1).
- the user A need only encrypt a file by means of a public key (to be referred to as a group public key hereinafter) of an entity (to be referred to as a group administrator hereinafter) who manages a group of users.
- the server re-encrypts the encrypted file (uploaded by the user A) based on a re-encryption key.
- an encrypted file which can be decrypted by each user is generated. Details of the proxy re-encryption system will be described later.
- the system (1) when a file is to be shared also by a new user D, the user A has to encrypt a file by means of a public key of the user D, and has to upload the encrypted file onto the server, thus posing a problem.
- the public key of the user D is an individual encryption key for the user D. Therefore, the system (1) is not suitable for the file sharing system since troublesome processing is required at the time of addition of a new user when the number of new users or the number of files to be shared is large.
- the common key system (2) when a file sharing permission for a certain user is canceled from a certain timing (to exclude that user from the file sharing system), a mechanism for updating the private key and public key common to the respective users is additionally required, thus posing a problem.
- the common key system (2) if the private key common to the respective users has leaked due to some reason, a person who acquired the leaked private key can decrypt all encrypted files, thus posing a problem. For this reason, the common key system (2) is not suitable for the file sharing system.
- the proxy re-encryption system (3) since the server re-encrypts one ciphertext to that which can be decrypted by each user, using a re-encryption key, a configuration which does not notify the users of the re-encryption key is adopted, thus solving the aforementioned problems. For this reason, the proxy re-encryption system (3) is suitable for the file sharing system.
- Non-Patent Literature 1 B. Libert and D. Vergnaud, "Unidirectional Chosen-Ciphertext Secure Proxy Re-encryption", Proc. PKC 2008, LNCS 4939, pp. 360 - 379, Springer, 2008 .
- a decryption right is redelegated. More specifically, when the server and users B and E collude, an authentic re-encryption key (rk A ⁇ E ) required to re-encrypt ciphertext for the user A to that for the user E is generated without any permission of the user A using a re-encryption key (rk A ⁇ B ) required to re-encrypt ciphertext for the user A to that for the user B, a private key (sk B ) of the user B, and a private key (sk E ) of the user E.
- rk A ⁇ E an authentic re-encryption key required to re-encrypt ciphertext for the user A to that for the user E is generated without any permission of the user A using a re-encryption key (rk A ⁇ B ) required to re-encrypt ciphertext for the user A to that for the user B, a private key (sk B ) of the user B, and a
- a solution to such problem of the present invention is to provide a re-encryption key generator, re-encryption apparatus, and program, which cannot generate a re-encryption key without any permission of a transfer source even when the server and users collude.
- a re-encryption key generator generates a re-encryption key required to re-encrypt, without decrypting, ciphertext data obtained by encrypting plaintext data by means of a first public key of a first user device to obtain re-encrypted text data which can be decrypted by a second private key of a second user device.
- the re-encryption key generator comprises first storage means, second storage means, first random number generation means, and re-encryption key generation means.
- the first storage means stores a first private key corresponding to the first public key.
- the second storage means stores a second public key corresponding to the second private key.
- the first random number generation means generates a first random number.
- the re-encryption key generation means generates the re-encryption key based on the first private key, the second public key, and the first random number.
- each of the following apparatuses can be implemented by either a hardware arrangement or a combined arrangement of hardware resources and software.
- the software of the combined arrangement programs, which are installed from a network or non-transitory computer-readable storage media M1 to M5 in a computer in advance, and are executed by processors of the computer to control the computer to implement functions of corresponding apparatuses, as shown in FIG. 1 , are used.
- a proxy re-encryption system will be described first.
- a basic model of the proxy re-encryption system includes five functions (to be also referred to as algorithms hereinafter), that is, key generation, encryption, decryption, re-encryption key generation, and re-encryption.
- the key generation, encryption, and decryption functions are the same as those of normal public key cryptosystem.
- a key generation algorithm KeyGen outputs a pair (pk, sk) of a public key pk and private key sk when a security parameter 1 k is input.
- An encryption algorithm Enc outputs ciphertext C A for a user A when a public key pk A of the user A and a message m are input.
- a decryption algorithm Dec outputs the message m when a private key sk A of the user A and the ciphertext C A for the user A are input.
- Re-encryption key generation ReKeyGen(pk A , sk A , pk B , sk B ) ⁇ rk A ⁇ B
- a re-encryption key generation algorithm ReKeyGen outputs a re-encryption key rk A ⁇ B when the public key pk A of the user A, the private key sk A of the user A, a public key pk B of a user B, and a private key sk B of the user B are input.
- a re-encryption algorithm ReEnc outputs ciphertext C B for the user B when the re-encryption key rk A ⁇ B and the ciphertext C A for the user A are input.
- a model called “non-interactive" which obviates the need for the private key sk B of the user B in inputs of the re-encryption key generation algorithm has been proposed.
- the file sharing system includes a server Sv as an information processing apparatus possessed by a service provider which provides a service, and user devices A, B, C,... as information processing apparatuses possessed by users of that service.
- the server Sv and user devices A, B, C,... are connected via a communication network.
- the communication network includes, for example, a wireless LAN (Local Area Network), wired LAN, optical communication network, telephone communication network, intranet, EthernetTM, Internet, and combinations thereof.
- FIG. 7 shows only one server Sv connected to the file sharing system, but a plurality of servers may be connected.
- the user devices A, B, C,... will also simply referred to as users A, B, C,..., or will be referred to as a first user device, second user device,... hereinafter.
- FIG. 8 is a diagram showing the file sharing system.
- This file sharing system includes a server Sv, user A, user B, user C, group administrator, and user administrator.
- the user administrator is an entity for managing all the users.
- the user administrator issues an ID and initial password which allow each user to log into the file sharing system for the user.
- each user has a public key pk Gr of the group administrator.
- m be file of plaintext to be shared.
- the server Sv has a re-encryption key rk Gr ⁇ A (or rk Gr ⁇ B or rk Gr ⁇ C ) required to re-encrypt ciphertext E(pk Gr , m) for the group administrator to ciphertext E(pk A , m) (or E(pk B , m) or E(pk C , m)) for the user A (or the user B or user C).
- each user i has a private key sk i . That is, the user A has a private key sk A , the user B has a private key sk B , and the user C has a private key sk C .
- the user C encrypts the file m by means of the public key pk Gr of the group administrator, which is stored in a public key storage unit 1, and uploads obtained ciphertext E(pk Gr , m) onto the server Sv.
- the server Sv stores this ciphertext in a ciphertext storage unit 2.
- the user A wants to share the file m.
- the user A transmits a re-encryption request of the ciphertext E(pk Gr , m) to the server Sv.
- the server Sv re-encrypts the ciphertext E(pk Gr , m) to ciphertext E(pk A , m) for the user A based on the re-encryption key rk Gr ⁇ A for the user A stored in a re-encryption key storage unit 3, and transmits the obtained re-encrypted text E(pk A , m) to the user A.
- the re-encrypted text is ciphertext obtained by re-encrypting ciphertext.
- the user A decrypts the re-encrypted text E(pk A , m) downloaded from the server Sv by means of the private key sk A in his or her possession, and uses the obtained file m.
- the file m has never been decrypted from encryption by the user C until decryption by the user A, thus blocking information leakage during the processes of file sharing.
- the user C need not determine file sharing users at the ciphertext upload timing. That is, the user C need only encrypt the file m by means of the public key pk Gr of the group administrator, and requires only the public key pk Gr of the group administrator as a key to be managed in association with encryption, thus reducing the key management cost.
- the server Sv does not have any decryption key sk Gr required to decrypt the ciphertext E(pk Gr , m). Therefore, the server Sv cannot decrypt this ciphertext. This means that there is no threat of leakage of ciphertext decrypted by the illicit server Sv, thus the server Sv need not be managed so strictly, resulting in a management cost reduction of the server Sv.
- FIG. 1 is a block diagram showing the arrangement of a re-encryption system according to the first embodiment.
- This re-encryption system includes a key generator 10, encryption apparatus 20, re-encryption key generator 30, re-encryption apparatus 40, and decryption apparatus 50.
- the key generator 10 generates various parameters of the re-encryption system, and a pair of keys; a public key and private key of the apparatuses 40 and 50.
- the encryption apparatus 20 transmits ciphertext data obtained by encrypting plaintext data using a public key corresponding to a private key of the re-encryption key generator 30 to the re-encryption apparatus 40.
- the re-encryption key generator 30 generates a re-encryption key using the private key of the re-encryption key generator 30, a public key of the decryption apparatus 50, and a random number.
- the re-encryption apparatus 40 transmits re-encrypted text data obtained by re-encrypting, without decrypting, the ciphertext data received from the encryption apparatus 20 by means of the re-encryption key to the decryption apparatus 50.
- the decryption apparatus 50 verifies the re-encrypted text data using a public key of the re-encryption key generator 30, and decrypts the re-encrypted text data using a private key corresponding to a public key of the apparatus 50, thus obtaining plaintext data.
- a plurality of apparatuses may be arranged as each of the re-encryption key generator 30, re-encryption apparatus 40, and decryption apparatus 50, but this embodiment will exemplify a case in which the system includes one each as these apparatuses.
- the apparatuses 10 to 50 are held by entities which execute the corresponding processes. If a user generates a pair of a public key and private key of himself or herself, the user holds the key generator 10. Note that when, for example, the user administrator or group administrator generates a pair of a public key and private key of each user, the user administrator or group administrator holds the key generator 10. The user holds one or both of the encryption apparatus 20 and decryption apparatus 50. The group administrator holds the re-encryption key generator 30. Note that when, for example, the user administrator or server Sv generates a re-encryption key, it holds the re-encryption key generator 30.
- the server Sv holds the re-encryption apparatus 40.
- the server Sv holds the public key storage unit 1, and the user C who executes encryption acquires a public key used in encryption from the public key storage unit 1.
- the present invention is not limited to this, and the user C may acquire the public key used in encryption from the key generator 10 (which generates the public key used in encryption).
- the server Sv stores the ciphertext E(pk Gr , m) generated by the user C in the ciphertext storage unit 2.
- the ciphertext storage unit 2 may be included in the re-encryption apparatus 40 or may be an external storage device which is not included in the re-encryption apparatus 40.
- the entities and apparatuses to be held by the entities are not limited to the aforementioned example, and various variations are possible.
- the user administrator or group administrator may or may not also serve as the user.
- the respective user devices used by the respective users may also be referred to as a first user device, second user device,....
- public keys and private keys of the respective user devices may also be referred to as a first public key and first private key of the first user device, a second public key and second private key of the second user device,....
- the key generator 10 includes a key generation parameter storage unit 11, temporary data storage unit 12, public parameter generation unit 13, public key/private key generation unit 14, communication unit 15, and control unit 16.
- the key generation parameter storage unit 11 is a storage device which stores key generation parameters.
- the temporary data storage unit 12 is a storage device which stores temporary data such as intermediate processing data, processing result data, and the like of the respective generation units 13 and 14.
- the public parameter storage unit 13 generates public parameters of key generation.
- the public key/private key generation unit 14 generates a public key and private key for each user.
- the communication unit 15 is a communication interface required to communicate with other apparatuses 20 to 50, and has, for example, the following functions (f15-1) and (f15-2).
- the control unit 16 has a function of controlling the units 11 to 15 to execute the operations shown in FIG. 2 .
- the encryption apparatus 20 includes a temporary data storage unit 21, communication unit 22, encrypted data generation unit 23, ciphertext generation unit 24, and control unit 25.
- the temporary data storage unit 21 is a storage device which stores the public key of the re-encryption key generator 30 received from the key generator 10, and tentative data (to be also referred to as temporary data hereinafter) such as intermediate processing data and processing result data of the generation units 23 and 24.
- the communication unit 22 is a communication interface required to communicate with other apparatuses 10 and 30 to 50, and has, for example, the following functions (f22-1) and (f22-2).
- the encryption parameter generation unit 23 has a function of generating encryption parameters.
- the ciphertext generation unit 24 has, for example, the following functions (f24-1) and (f24-2).
- the control unit 25 has a function of controlling the respective units 21 to 24 so as to execute operations shown in FIG. 3 .
- the re-encryption key generator 30 includes a private key storage unit 31, temporary data storage unit 32, communication unit 33, re-encryption key generation unit 34, control unit 35, and random number generation unit 36.
- the private key storage unit 31 is a storage device which stores the private key of the re-encryption key generator 30 received from the key generator 10.
- the temporary data storage unit 32 is a storage device which stores the public key of the decryption apparatus 50 received from the key generator 10, and temporary data such as intermediate processing data and processing result data of the re-encryption key generation unit 34.
- the communication unit 33 is a communication interface required to communicate with other apparatuses 10, 20, 40, and 50, and has, for example, a function of transmitting the re-encryption key in the temporary data storage unit 32 to the re-encryption apparatus 40 under the control of the control unit 35.
- the re-encryption key generation unit 34 has, for example, the following functions (f34-1) and (f34-2).
- (f34-1) A function of generating a re-encryption key based on the private key (the first private key of the first user device) of the re-encryption key generator 30, which key is read out from the private key storage unit 31, the public key (the second public key of the second user device) of the decryption apparatus 50, which key is read out from the temporary data storage unit 32, and a random number generated by the random number generation unit 36 (this function does not require any parameter (more specifically, a random number) at the time of encryption).
- the control unit 35 has a function of controlling the respective units 31 to 34 and 36 so as to execute the operations shown in FIG. 4 .
- the random number generation unit 36 has a function of generating and outputting a random number to the re-encryption key generation unit 34.
- the re-encryption apparatus 40 includes a re-encryption key storage unit 41, temporary data storage unit 42, communication unit 43, re-encryption processing unit 44, re-encryption parameter generation unit 45, and control unit 47.
- the re-encryption key storage unit 41 is a storage device which stores the re-encryption key received from the re-encryption key generator 30.
- the temporary data storage unit 42 is a storage device which stores temporary data such as intermediate processing data and processing result data of the re-encryption processing unit 44.
- the communication unit 43 is a communication interface required to communicate with other apparatuses 10 to 30 and 50, and has, for example, the following functions (f43-1) and (f43-2).
- (f43-1) A function of outputting ciphertext data received from the encryption apparatus 20 to the re-encryption processing unit 44.
- the re-encryption processing unit 44 has, for example, the following functions (f44-1) and (f44-2).
- the control unit 47 has a function of controlling the respective units 41 to 45 so as to execute an operation for delivering a re-encrypted text verification program (not shown) and operations shown in FIG. 5 .
- the decryption apparatus 50 includes a private key storage unit 51, temporary data storage unit 52, communication unit 53, decryption processing unit 54, and control unit 56.
- the private key storage unit 51 is a storage device which stores the private key of the apparatus 50 received from the key generator 10.
- the temporary data storage unit 52 is a storage device which stores the public key of the apparatus 50 and that of the re-encryption key generator 30, which keys are received from the key generator 10, and temporary data such as intermediate processing data and processing data of the decryption processing unit 54.
- the communication unit 53 is a communication interface required to communicate with other apparatuses 10 to 40, and has, for example, the following functions (f53-1) to (f53-3).
- the decryption processing unit 54 has, for example, the following functions (f54-1) to (f54-2).
- (f54-1) A function of obtaining plaintext data by decrypting re-encrypted text data received from the re-encryption apparatus 40 based on the private key (the second private key of the second user device) of the decryption apparatus 50, which key is read out from the private key storage unit 51.
- the control unit 56 has a function of controlling the respective units 51 to 54 so as to execute operations shown in FIG. 6 .
- the following operations will be described taking, as an example, a case in which they are executed in an order of (1) key setup processing, (2) encryption processing, (3) re-encryption key generation processing, (4) re-encryption processing, and (5) decryption processing.
- the following operations need not always be executed in the aforementioned order.
- the re-encryption key generation may be executed before the encryption processing.
- ciphertext data may be decrypted without executing the re-encryption processing.
- the public parameter generation unit 13 of the key generator 10 generates or externally acquires public parameters (p, ⁇ , G, G T , g, g 1 , g 2 , u, v, Sig( ⁇ , ⁇ ,V ⁇ )) (step ST1). More specifically, the pubic parameter generation unit 13 generates, based on a security parameter ⁇ stored in advance in the key parameter storage unit 11, bilinear map groups (G, G T ) which satisfy the prime order p > 2 ⁇ , members g, g 1 , g 2 , u, and v of G, and a one-time signature algorithm Sig( ⁇ , ⁇ ,V ⁇ ) which satisfies strong unforgeability.
- the term "member” is a term having a mathematical meaning, is also called an element, and indicates each individual one in a set including a plurality of "ones”.
- G means a function of generating a one-time key pair (ssk, svk)
- S means a function of generating a signature ⁇ for a message M
- V means a function of verifying authenticity of the signature ⁇ .
- the bilinear map (to be expressed by "e") is a map e: G x G ⁇ G T , and satisfies the following three properties.
- the plurality of members g, g 1 , and g 2 of G are a plurality of predetermined system fixed values.
- the plurality of system fixed values are not limited to the three members of the bilinear map group G, and a plurality of members (for example, two or four or more members) of G can be used as needed.
- the term "system fixed value” may be read as "fixed value", "member", or "system parameter”.
- the plurality of system fixed values are a plurality of members of a bilinear map group as a group of prime orders including a bilinear map.
- G and G T can be expressed by a notation which regards them as additive groups. That is, for example, G may be expressed as an additive group, and G T may be expressed as a multiplicative group.
- a map e: G 1 ⁇ G 2 ⁇ G T for bilinear map groups G 1 , G 2 , and G T (G 1 and G 2 are different groups) may be used. The same applies to other embodiments.
- the public parameter generation unit 13 writes the generated public parameters in the temporary data storage unit 12.
- the key generator 10 publishes the public parameters (p, ⁇ , G, G T , g, g 1 , g 2 , u, v, Sig) in the temporary data storage unit 12 (step ST2). Note that when the public parameters have already been published before execution of step ST1, these public parameters may be written in the temporary data storage unit 12, and steps ST1 and ST2 may be skipped.
- the public key/private key generation unit 14 writes the generated public key/private key pair in the temporary data storage unit 12.
- the communication unit 15 transmits the private key ski in the temporary data storage unit 12 to the re-encryption key generator 30 under the control of the control unit 16 (step ST8).
- the key generator 10 publishes the public key pki of the re-encryption key generator 30 in the temporary data storage unit 12 (step ST9).
- the public key/private key generation unit 14 writes the generated public key/private key pair in the temporary data storage unit 12.
- the communication unit 15 transmits the private key sk j in the temporary data storage unit 12 to the decryption apparatus 50 under the control of the control unit 16 (step ST11).
- the key generator 10 publishes the public key pk j of the decryption apparatus 50 in the temporary data storage unit 12 (step ST12). Also, if required, the same processes as those in steps ST10 to ST12 may be executed for a private key sk h and public key pk h of the encryption apparatus 20, the private key sk h may be transmitted to the encryption apparatus 20, and the public key pk h may be published.
- the key setup processing is complete. After that, the apparatuses 20, 30, 40, and 50 can acquire and use the public parameters and public keys published in steps ST2, ST6, ST9, and ST12 as needed.
- the encryption parameter generation unit 23 generates a random number r ⁇ z p *, and outputs it to the ciphertext generation unit 24.
- the ciphertext generation unit 24 generates encrypted data C 2X , C 2Y , C 2Z , C 2Z1 , C 3 , and C 4 for a message m ⁇ G T as plaintext data using this random number r and the public key pk i of the re-encryption key generator 30 (step ST22).
- the ciphertext generation unit 24 After completion of step ST22, the ciphertext generation unit 24 generates, for the encrypted data C 3 and C 4 , a one-time signature ⁇ by means of the signature generation function S in the public parameters and the signature key ssk generated in step ST21 (step ST23).
- the communication unit 22 transmits the ciphertext data C i in the temporary data storage unit 21 to the re-encryption apparatus 40 under the control of the control unit 25 (step ST24).
- verification may be skipped and generation of the verification data may be skipped, as described above (or as will be described later). This applies to the following embodiments and modifications.
- the communication unit 33 of the re-encryption key generator 30 acquires the public key pk j of the decryption apparatus 50 published from the key generator 10 and writes it in the temporary data storage unit 32 under the control of the control unit 35 (step ST31). Also, in step ST5 described above, the communication unit 33 received the private key ski of the re-encryption key generator 30 from the key generator 10 and wrote it in the private key storage unit 31.
- the random number generation unit 36 generates a random number ⁇ ⁇ z p *, and outputs it to the re-encryption key generation unit 34.
- the re-encryption key generation unit 34 generates a re-encryption key R ij based on this random number ⁇ , the private key ski of the re-encryption key generator 30 in the private key storage unit 31, and the public key pk j of the decryption apparatus 50 in the temporary data storage unit 32 (step ST32).
- the re-encryption key generation unit 34 writes the generated re-encryption key R ij in the temporary data storage unit 32.
- the communication unit 33 transmits the re-encryption key R ij in the temporary data storage unit 32 to the re-encryption apparatus 40 under the control of the control unit 35 (step ST33).
- the communication unit 43 of the re-encryption apparatus 40 writes the ciphertext data C i transmitted in step ST24 and the re-encryption key R ij transmitted in step ST33 in the temporary data storage unit 42.
- the re-encryption processing unit 44 verifies the ciphertext data C i in the temporary data storage unit 42 using the public parameters and the following verification formulas (step ST41).
- the re-encryption parameter generation unit 45 If the verification has succeeded, the re-encryption parameter generation unit 45 generates three random numbers s, t, and k ⁇ z p *, and outputs them to the re-encryption processing unit 44.
- the re-encryption processing unit 44 generates re-encrypted data C 2X ', C 2X ", C 2Y ', C 2Y “, C 2Z ', C 2Z ", C 2Z1 ', C 2Z1 ", C 2 "', C 5X , C 5Y , and C 5Z using these random numbers s, t, and k, the ciphertext data C i in the temporary data storage unit 42, and the re-encryption key R ij in the temporary data storage unit 42 (step ST42).
- the processing for generating the verification data (C 2X ', C 2Y ', C 2Z ', C 2Z1
- the communication unit 43 transmits the re-encrypted text data C j in the temporary data storage unit 42 to the decryption apparatus 50 under the control of the control unit 47 (step ST43).
- the communication unit 53 of the decryption apparatus 50 receives the re-encrypted text data C j transmitted in step ST43, and writes it in the temporary data storage unit 52.
- the decryption processing unit 54 verifies the re-encrypted text data C j in the temporary data storage unit 52 using the public parameters, the public key pk j of the apparatus 50, and the following verification formulas (step ST51).
- the decryption processing unit 54 decrypts the re-encrypted text data C j using the private key sk j of the apparatus to obtain the message m (step ST52).
- the decryption processing unit 54 may skip the verification processing of step ST51, and may execute the decryption processing of step ST52. Also, when the re-encrypted text data C j does not include any verification data, the decryption processing unit 54 skips the verification processing of step ST51 and executes the decryption processing of step ST52.
- the order of processes may be changed as needed in this embodiment.
- the order of the decryption processing and ciphertext verification processing may be changed.
- the re-encryption key generation processing may be executed before the encryption processing.
- the decryption authority since the re-encryption key R ij is generated based on the random number ⁇ , even when the server and users collude, the decryption authority can be prevented from being re-transferred without any permission of a transfer source. In this manner, since extremely high reliability need not be required for the server, a file sharing system which can be used by the users more securely can be provided.
- the encryption apparatus 20 generates ciphertext data
- the re-encryption apparatus 40 re-encrypts the ciphertext data to generate re-encrypted text data
- the decryption apparatus 50 decrypts the re-encrypted text data.
- the first embodiment may be modified to a mode in which ciphertext data is decrypted without re-encryption. In this case, only the key setup processing, encryption processing, and decryption processing can be executed.
- the key setup processing in this modification is the same as that in the first embodiment.
- the encryption processing and decryption processing in this modification will be described below.
- the difference between the encryption processing of this modification and that of the first embodiment is only in the final step.
- the communication unit 22 of the encryption apparatus 20 transmits ciphertext data C i in the temporary data storage unit 21 to the decryption apparatus 50 under the control of the control unit 25 (step ST24').
- the first embodiment may be modified to a mode in which ciphertext data is decrypted without re-encryption.
- key setup processing, encryption processing, and decryption processing can be executed.
- the key setup processing and decryption processing of this modification are the same as those in the first embodiment.
- the encryption processing and decryption processing of this modification will be described below.
- j refers to identification information of the decryption apparatus 50 in this modification.
- the encryption parameter generation unit 23 generates five random numbers; r, s, t, k, and ⁇ ⁇ z p *, and outputs them to the ciphertext generation unit 24.
- the ciphertext generation unit 24 generates encrypted data C 2X ', C 2X “, C 2Y ', C 2Y “, C 2Z ', C 2Z “, C 2Z1 ', C 2Z1 ", C 2 "', C 5X , C 5Y , C 5Z , C 3 , and C 4 with respect to a message m ⁇ G T as plaintext data using these random numbers r, s, t, k, and ⁇ , and the public key pk j of the decryption apparatus 50 (step ST22').
- step ST22' After completion of step ST22', the ciphertext generation unit 24 generates a one-time signature ⁇ in the same manner as in step ST23.
- the communication unit 22 transmits the ciphertext data C j in the temporary data storage unit 21 to the decryption apparatus 50 under the control of the control unit 25.
- the public parameters include the three members g, g 1 , and g 2 of the system fixed values.
- the present invention is not limited to this.
- the member g 2 may not be generated, and the public parameters may not include the member g 2 .
- g 2 g may be set to replace g 2 by g. The same applies to the following embodiments and modifications.
- the public parameters include the three members g, g 1 , and g 2 of the system fixed values.
- the public parameters may include four or more members of the system fixed values.
- a time parameter L is used as a parameter which expresses a period.
- the encryption processing, re-encryption key generation processing, re-encryption processing, and decryption processing use the time parameter.
- the encryption parameter generation unit 23 generates a random number r ⁇ Z p *, and outputs it to a ciphertext generation unit 24.
- the ciphertext generation unit 24 generates encrypted data C 2X , C 2Y , C 2Z , C 2Z1 , C 2F , C 3 , and C 4 with respect to a message m ⁇ G T as plaintext data using this random number r, the public key pk i of the re-encryption key generator 30, and the time parameter L (step ST22).
- the ciphertext generation unit 24 After completion of step ST22, the ciphertext generation unit 24 generates, for the time parameter L and the encrypted data C 3 and C 4 , a one-time signature ⁇ by means of a signature generation function S in the public parameters and the signature key ssk generated in step ST21 (step ST23).
- a random number generation unit 36 generates three random numbers; ⁇ , ⁇ x , and ⁇ y ⁇ Z p *, and outputs them to a re-encryption key generation unit 34.
- the re-encryption key generation unit 34 generates a re-encryption key R ijL using these random numbers ⁇ , ⁇ x , and ⁇ y , the private key ski of the re-encryption key generator 30 in a private key storage unit 31, and the public key pk j of the decryption apparatus 50 in a temporary data storage unit 32 (step ST32).
- a re-encryption processing unit 44 verifies ciphertext data C i in a temporary data storage unit 42 using the public parameters, the time parameter L, and the following verification formulas (step ST41).
- a re-encryption parameter generation unit 45 If the verification has succeeded, a re-encryption parameter generation unit 45 generates four random numbers; s, t, k, and h ⁇ Z p *, and outputs them to a re-encryption processing unit 44.
- the re-encryption processing unit 44 generates re-encrypted data C 2X ', C 2X “, C 2Y ', C 2Y “, C 2Z ', C 2Z “, C 2Z1 ', C 2Z1 ", C 2F ', C 2F “, C 5X , C 5Y , C 5Z , C 5FX , and C 5FY using these random numbers s, t, k, and h, the ciphertext data C i in the temporary data storage unit 42, the re-encryption key R ijL in the temporary data storage unit 42, and the time parameter L (step ST42).
- a decryption processing unit 54 verifies the re-encrypted text data C j in a temporary data storage unit 52 using the public parameters, the public key pk j of the apparatus 50, and the following verification formulas (step ST51).
- the decryption processing unit 54 decrypts the re-encrypted text data C j using the private key sk j of the apparatus to obtain a message m (step ST52).
- the order of processes may be changed as needed in this embodiment.
- the order of the decryption processing and ciphertext verification processing may be changed.
- the re-encryption key generation processing may be executed before the encryption processing.
- the decryption authority about ciphertext for a user A is transferred to a user B in a certain period, the decryption authority about ciphertext for the user A is not given to the user B in the next period, that is, the decryption authority of the user B (about ciphertext for the user A) can be invalidated, thus providing a more convenient file sharing system.
- the encryption apparatus 20 generates ciphertext data
- a re-encryption apparatus 40 re-encrypts the ciphertext data to generate re-encrypted text data
- the decryption apparatus 50 decrypts the re-encrypted text data.
- the second embodiment may be modified to a mode in which ciphertext data is decrypted without re-encryption. In this case, only the key setup processing, encryption processing, and decryption processing can be executed.
- the key setup processing in this modification is the same as that in the second embodiment.
- the encryption processing and decryption processing in this modification will be described below.
- a communication unit 22 of the encryption apparatus 20 transmits ciphertext data C i in the temporary data storage unit 21 to the decryption apparatus 50 under the control of a control unit 25 (step ST24').
- the first embodiment may be modified to an aspect in which ciphertext data is decrypted without re-encryption.
- key setup processing, encryption processing, and decryption processing can be executed.
- the key setup processing and decryption processing of this modification are the same as those in the second embodiment.
- the encryption processing and decryption processing of this modification will be described below.
- j refers to identification information of the decryption apparatus 50 in this modification.
- the encryption parameter generation unit 23 generates eight random numbers; r, s, t, k, h, ⁇ , ⁇ x , and ⁇ y ⁇ Z p *, and outputs them to the ciphertext generation unit 24.
- the ciphertext generation unit 24 generates encrypted data C 2X ', C 2X “, C 2Y ', C 2Y “, C 2Z ', C 2Z “, C 2Z1 ', C 2Z1 ", C 2F ', C 2F “, C 5X , C 5Y , C 5Z , C 5FX , C 5FY , C 3 , and C 4 with respect to a message m ⁇ G T as plaintext data using these random numbers r, s, t, k, h, ⁇ , ⁇ x , and ⁇ y , the public key pk j of the decryption apparatus 50, and the time parameter L (step ST22').
- step ST22' After completion of step ST22', the ciphertext generation unit 24 generates a one-time signature ⁇ in the same manner as in step ST23.
- the communication unit 22 transmits the ciphertext data C j in the temporary data storage unit 21 to the decryption apparatus 50 under the control of the control unit 25.
- the decryption apparatus 50 verifies the ciphertext data C j generated by the encryption apparatus 20 in the same manner as in step ST51. If the verification has succeeded, the decryption apparatus 50 decrypts the ciphertext data C j using the private key sk j to obtain a message m.
- the decryption authority since a re-encryption key is generated based on a random number, even when the server and users collude, the decryption authority can be prevented from being re-transferred without any permission of a transfer source.
- the method described in each embodiment can also be stored in a storage medium such as a magnetic disk (floppyTM disk, hard disk, or the like), an optical disk (CD-ROM, DVD, or the like), a magneto-optical disk (MO), or a semiconductor memory as a program which can be executed by a computer and distributed.
- a storage medium such as a magnetic disk (floppyTM disk, hard disk, or the like), an optical disk (CD-ROM, DVD, or the like), a magneto-optical disk (MO), or a semiconductor memory as a program which can be executed by a computer and distributed.
- any configuration which is a computer-readable storage medium in which a program can be stored may be used regardless of a storage format.
- An OS which operates on a computer on the basis of an instruction of a program installed from the storage medium in the computer, database management software, and MW (middleware) such as network software may execute a part of the processes to realize the embodiment.
- the storage medium according to each embodiment includes not only a medium independent of a computer but also a storage medium in which a program transmitted through a LAN, the Internet, or the like is downloaded and stored or temporarily stored.
- the number of storage media is not limited to one. A case in which the process in each embodiment is executed from a plurality of media is included in the storage medium according to the present invention. Any medium configuration may be used.
- a computer is to execute the processes in each embodiment on the basis of the program stored in a storage medium.
- the computer may have any configuration such as one apparatus constituted by a personal computer or a system in which a plurality of apparatuses are connected by a network.
- a computer in each embodiment includes not only a personal computer but also an arithmetic processing apparatus, a microcomputer, or the like included in an information processing apparatus.
- the computer is a generic name of an apparatus and a device which can realize the functions of the present invention by a program.
Abstract
Description
- Embodiments described herein relate generally to a re-encryption key generator, re-encryption apparatus, and program.
- In a file sharing system in which the user uploads a file onto a server, and that file is shared by a plurality of users, as a method of maintaining the secrecy of file with respect to the server, the following three methods (1) to (3) are used.
- (1) An individual key system for encrypting a file by means of an individual encryption key for each user.
- (2) A common key system for encrypting a file by means of an encryption key common to respective users.
- (3) A re-encryption system for encrypting a file using a proxy re-encryption system.
- In the systems (1) to (3), assume that a user A uploads a file onto a server, and the user A shares the file with users B and C.
- In the individual key system (1), each user has a pair of a private key and public key, which are different for each user. The user A encrypts a file by means of a public key of the user B, and uploads the encrypted file onto the server. Note that the public key of the user B is an individual encryption key for the user B. Likewise, the user A encrypts a file by means of a public key of the user C, and uploads the encrypted file onto the server. The public key of the user C is an individual encryption key for the user C. That is, the user A encrypts a file individually for the users who share that file.
- In the common key system (2), each user shares a pair of a private key and public key, which are common to the respective users. The user A encrypts a file by means of a public key (as an encryption key common to the respective users), and uploads the encrypted file onto the server. The respective users share an identical private key.
- In the proxy re-encryption system (3), each user has a pair of a private key and public key, which are different for respective users like in the individual key system (1). However, unlike in the individual key system (1), the user A need only encrypt a file by means of a public key (to be referred to as a group public key hereinafter) of an entity (to be referred to as a group administrator hereinafter) who manages a group of users. The server re-encrypts the encrypted file (uploaded by the user A) based on a re-encryption key. By the re-encryption, an encrypted file which can be decrypted by each user is generated. Details of the proxy re-encryption system will be described later.
- In the individual key system (1), when a file is to be shared also by a new user D, the user A has to encrypt a file by means of a public key of the user D, and has to upload the encrypted file onto the server, thus posing a problem. Note that the public key of the user D is an individual encryption key for the user D. Therefore, the system (1) is not suitable for the file sharing system since troublesome processing is required at the time of addition of a new user when the number of new users or the number of files to be shared is large.
- In the common key system (2), when a file sharing permission for a certain user is canceled from a certain timing (to exclude that user from the file sharing system), a mechanism for updating the private key and public key common to the respective users is additionally required, thus posing a problem. In the common key system (2), if the private key common to the respective users has leaked due to some reason, a person who acquired the leaked private key can decrypt all encrypted files, thus posing a problem. For this reason, the common key system (2) is not suitable for the file sharing system.
- On the other hand, in the proxy re-encryption system (3), since the server re-encrypts one ciphertext to that which can be decrypted by each user, using a re-encryption key, a configuration which does not notify the users of the re-encryption key is adopted, thus solving the aforementioned problems. For this reason, the proxy re-encryption system (3) is suitable for the file sharing system.
- Non-Patent Literature 1: B. Libert and D. Vergnaud, "Unidirectional Chosen-Ciphertext Secure Proxy Re-encryption", Proc. PKC 2008, LNCS 4939, pp. 360 - 379, Springer, 2008.
- However, in the proxy re-encryption system (3), when the server and users collude, a decryption right is redelegated. More specifically, when the server and users B and E collude, an authentic re-encryption key (rkA→E) required to re-encrypt ciphertext for the user A to that for the user E is generated without any permission of the user A using a re-encryption key (rkA→B) required to re-encrypt ciphertext for the user A to that for the user B, a private key (skB) of the user B, and a private key (skE) of the user E.
- A solution to such problem of the present invention is to provide a re-encryption key generator, re-encryption apparatus, and program, which cannot generate a re-encryption key without any permission of a transfer source even when the server and users collude.
- A re-encryption key generator according to an embodiment generates a re-encryption key required to re-encrypt, without decrypting, ciphertext data obtained by encrypting plaintext data by means of a first public key of a first user device to obtain re-encrypted text data which can be decrypted by a second private key of a second user device.
- The re-encryption key generator comprises first storage means, second storage means, first random number generation means, and re-encryption key generation means.
- The first storage means stores a first private key corresponding to the first public key.
- The second storage means stores a second public key corresponding to the second private key.
- The first random number generation means generates a first random number.
- The re-encryption key generation means generates the re-encryption key based on the first private key, the second public key, and the first random number.
-
-
FIG. 1 is a block diagram showing the arrangement of a re-encryption system according to the first embodiment. -
FIG. 2 is a sequence chart for explaining the operation of key setup processing according to the first embodiment. -
FIG. 3 is a sequence chart for explaining the operation of encryption processing according to the first embodiment. -
FIG. 4 is a sequence chart for explaining the operation of re-encryption key generation processing according to the first embodiment. -
FIG. 5 is a sequence chart for explaining the operation of re-encryption processing according to the first embodiment. -
FIG. 6 is a sequence chart for explaining the operation of decryption processing according to the first embodiment. -
FIG. 7 is a block diagram showing an example of the arrangement of a file sharing system according to the first embodiment. -
FIG. 8 is a diagram of the file sharing system according to the first embodiment. - Embodiments will be described hereinafter with reference to the drawings. Note that each of the following apparatuses can be implemented by either a hardware arrangement or a combined arrangement of hardware resources and software. As the software of the combined arrangement, programs, which are installed from a network or non-transitory computer-readable storage media M1 to M5 in a computer in advance, and are executed by processors of the computer to control the computer to implement functions of corresponding apparatuses, as shown in
FIG. 1 , are used. - A proxy re-encryption system will be described first. A basic model of the proxy re-encryption system includes five functions (to be also referred to as algorithms hereinafter), that is, key generation, encryption, decryption, re-encryption key generation, and re-encryption. The key generation, encryption, and decryption functions are the same as those of normal public key cryptosystem.
- A key generation algorithm KeyGen outputs a pair (pk, sk) of a public key pk and private key sk when a
security parameter 1k is input. - An encryption algorithm Enc outputs ciphertext CA for a user A when a public key pkA of the user A and a message m are input.
- A decryption algorithm Dec outputs the message m when a private key skA of the user A and the ciphertext CA for the user A are input.
- A re-encryption key generation algorithm ReKeyGen outputs a re-encryption key rkA→B when the public key pkA of the user A, the private key skA of the user A, a public key pkB of a user B, and a private key skB of the user B are input.
- A re-encryption algorithm ReEnc outputs ciphertext CB for the user B when the re-encryption key rkA→B and the ciphertext CA for the user A are input.
- The basic model has been described. However, according to the re-encryption implementation method used, models having different inputs to functions, and those including functions and keys other than those described above have also been proposed.
- For example, like in the re-encryption method to be described in this embodiment, a model called "non-interactive", which obviates the need for the private key skB of the user B in inputs of the re-encryption key generation algorithm has been proposed. Also, a model in which the re-encryption key rkA→B for the user B and a private key skC of a user C are input in place of the private key skA of the user A has also been proposed.
- In addition, a model called "unidirectional" which allows re-encryption of ciphertext CA → CB by means of the re-encryption key rkA→B, while inhibits inverse conversion of ciphertext CB → CA, and a model called "bidirectional" which permits that inverse conversion are known. Note that in the bidirectional model, the re-encryption key rkA→B is also expressed as rkA⇔B.
- Furthermore, a system based on ID-based encryption of the public key cryptosystem has been proposed. In this case, function setup processing is added for master key generation, and a master key and ID are added to inputs of the key generation algorithm. In the ID-based encryption, the public key pk is an ID itself.
- The arrangement of a file sharing system according to this embodiment will be described below with reference to
FIG. 7 . The file sharing system includes a server Sv as an information processing apparatus possessed by a service provider which provides a service, and user devices A, B, C,... as information processing apparatuses possessed by users of that service. The server Sv and user devices A, B, C,... are connected via a communication network. The communication network includes, for example, a wireless LAN (Local Area Network), wired LAN, optical communication network, telephone communication network, intranet, Ethernet™, Internet, and combinations thereof. Note thatFIG. 7 shows only one server Sv connected to the file sharing system, but a plurality of servers may be connected. Also, the user devices A, B, C,... will also simply referred to as users A, B, C,..., or will be referred to as a first user device, second user device,... hereinafter. -
FIG. 8 is a diagram showing the file sharing system. This file sharing system includes a server Sv, user A, user B, user C, group administrator, and user administrator. The user administrator is an entity for managing all the users. The user administrator issues an ID and initial password which allow each user to log into the file sharing system for the user. - As an advance preparation, assume that each user has a public key pkGr of the group administrator. Also, let m be file of plaintext to be shared. Assume that the server Sv has a re-encryption key rkGr→A (or rkGr→B or rkGr→C) required to re-encrypt ciphertext E(pkGr, m) for the group administrator to ciphertext E(pkA, m) (or E(pkB, m) or E(pkC, m)) for the user A (or the user B or user C). Assume that each user i has a private key ski. That is, the user A has a private key skA, the user B has a private key skB, and the user C has a private key skC.
- Next, the user C encrypts the file m by means of the public key pkGr of the group administrator, which is stored in a public
key storage unit 1, and uploads obtained ciphertext E(pkGr, m) onto the server Sv. The server Sv stores this ciphertext in aciphertext storage unit 2. - Now assume that the user A wants to share the file m. The user A transmits a re-encryption request of the ciphertext E(pkGr, m) to the server Sv. In response to the request received from the user A, the server Sv re-encrypts the ciphertext E(pkGr, m) to ciphertext E(pkA, m) for the user A based on the re-encryption key rkGr→A for the user A stored in a re-encryption key storage unit 3, and transmits the obtained re-encrypted text E(pkA, m) to the user A. Note that the re-encrypted text is ciphertext obtained by re-encrypting ciphertext.
- The user A decrypts the re-encrypted text E(pkA, m) downloaded from the server Sv by means of the private key skA in his or her possession, and uses the obtained file m.
- In the aforementioned file sharing system, the file m has never been decrypted from encryption by the user C until decryption by the user A, thus blocking information leakage during the processes of file sharing.
- The user C need not determine file sharing users at the ciphertext upload timing. That is, the user C need only encrypt the file m by means of the public key pkGr of the group administrator, and requires only the public key pkGr of the group administrator as a key to be managed in association with encryption, thus reducing the key management cost.
- In this file sharing system, the server Sv does not have any decryption key skGr required to decrypt the ciphertext E(pkGr, m). Therefore, the server Sv cannot decrypt this ciphertext. This means that there is no threat of leakage of ciphertext decrypted by the illicit server Sv, thus the server Sv need not be managed so strictly, resulting in a management cost reduction of the server Sv.
- The same applies to a case of file sharing by the user B.
-
FIG. 1 is a block diagram showing the arrangement of a re-encryption system according to the first embodiment. (The correspondence relationship betweenFIGS. 1 and8 will be described later.) This re-encryption system includes akey generator 10,encryption apparatus 20, re-encryptionkey generator 30,re-encryption apparatus 40, anddecryption apparatus 50. Note that thekey generator 10 generates various parameters of the re-encryption system, and a pair of keys; a public key and private key of theapparatuses - The
encryption apparatus 20 transmits ciphertext data obtained by encrypting plaintext data using a public key corresponding to a private key of the re-encryptionkey generator 30 to there-encryption apparatus 40. - The re-encryption
key generator 30 generates a re-encryption key using the private key of the re-encryptionkey generator 30, a public key of thedecryption apparatus 50, and a random number. - The
re-encryption apparatus 40 transmits re-encrypted text data obtained by re-encrypting, without decrypting, the ciphertext data received from theencryption apparatus 20 by means of the re-encryption key to thedecryption apparatus 50. - The
decryption apparatus 50 verifies the re-encrypted text data using a public key of the re-encryptionkey generator 30, and decrypts the re-encrypted text data using a private key corresponding to a public key of theapparatus 50, thus obtaining plaintext data. Note that a plurality of apparatuses may be arranged as each of the re-encryptionkey generator 30,re-encryption apparatus 40, anddecryption apparatus 50, but this embodiment will exemplify a case in which the system includes one each as these apparatuses. - The correspondence relationship between
FIGS. 1 and8 will be described below. Theapparatuses 10 to 50 are held by entities which execute the corresponding processes. If a user generates a pair of a public key and private key of himself or herself, the user holds thekey generator 10. Note that when, for example, the user administrator or group administrator generates a pair of a public key and private key of each user, the user administrator or group administrator holds thekey generator 10. The user holds one or both of theencryption apparatus 20 anddecryption apparatus 50. The group administrator holds the re-encryptionkey generator 30. Note that when, for example, the user administrator or server Sv generates a re-encryption key, it holds the re-encryptionkey generator 30. The server Sv holds there-encryption apparatus 40. In the file sharing system exemplified inFIG. 8 , the server Sv holds the publickey storage unit 1, and the user C who executes encryption acquires a public key used in encryption from the publickey storage unit 1. However, the present invention is not limited to this, and the user C may acquire the public key used in encryption from the key generator 10 (which generates the public key used in encryption). Also, the server Sv stores the ciphertext E(pkGr, m) generated by the user C in theciphertext storage unit 2. Alternatively, theciphertext storage unit 2 may be included in there-encryption apparatus 40 or may be an external storage device which is not included in there-encryption apparatus 40. - The entities and apparatuses to be held by the entities are not limited to the aforementioned example, and various variations are possible. The user administrator or group administrator may or may not also serve as the user. The respective user devices used by the respective users may also be referred to as a first user device, second user device,.... Likewise, public keys and private keys of the respective user devices may also be referred to as a first public key and first private key of the first user device, a second public key and second private key of the second user device,....
- The arrangements of the
respective apparatuses 10 to 50 will be described in detail below. - The
key generator 10 includes a key generationparameter storage unit 11, temporarydata storage unit 12, publicparameter generation unit 13, public key/privatekey generation unit 14,communication unit 15, andcontrol unit 16. - The key generation
parameter storage unit 11 is a storage device which stores key generation parameters. - The temporary
data storage unit 12 is a storage device which stores temporary data such as intermediate processing data, processing result data, and the like of therespective generation units - The public
parameter storage unit 13 generates public parameters of key generation. - The public key/private
key generation unit 14 generates a public key and private key for each user. - The
communication unit 15 is a communication interface required to communicate withother apparatuses 20 to 50, and has, for example, the following functions (f15-1) and (f15-2). - (f15-1) A function of transmitting public key/private key pairs of 30 and 50 in the temporary
data storage unit 12 to theapparatuses control unit 16. - (f15-2) A function of transmitting a public key of the re-encryption
key generator 30 in the temporarydata storage unit 12 to theencryption apparatus 20 under the control of thecontrol unit 16. - Note that in the following description, a description about mediation of the
communication unit 15 and transmission/reception timings may be omitted to avoid redundant descriptions. The same applies to communication units ofother apparatuses 20 to 50. - The
control unit 16 has a function of controlling theunits 11 to 15 to execute the operations shown inFIG. 2 . - The
encryption apparatus 20 includes a temporarydata storage unit 21,communication unit 22, encrypteddata generation unit 23, ciphertext generation unit 24, andcontrol unit 25. - The temporary
data storage unit 21 is a storage device which stores the public key of the re-encryptionkey generator 30 received from thekey generator 10, and tentative data (to be also referred to as temporary data hereinafter) such as intermediate processing data and processing result data of thegeneration units 23 and 24. - The
communication unit 22 is a communication interface required to communicate withother apparatuses - (f22-1) A function of acquiring the public key of the re-encryption
key generator 30 published by thekey generator 10 and writing the acquired public key in the temporarydata storage unit 21. - (f22-2) A function of transmitting ciphertext data in the temporary
data storage unit 21 to there-encryption apparatus 40 under the control of thecontrol unit 25. - The encryption
parameter generation unit 23 has a function of generating encryption parameters. - The ciphertext generation unit 24 has, for example, the following functions (f24-1) and (f24-2).
- (f24-1) A function of generating ciphertext data by encrypting plaintext data using the public key (the first public key of the first user device) of the re-encryption
key generator 30, which key is read out from the temporarydata storage unit 21. - (f24-2) A function of writing the obtained ciphertext data in the
temporary storage unit 21. - The
control unit 25 has a function of controlling therespective units 21 to 24 so as to execute operations shown inFIG. 3 . - The re-encryption
key generator 30 includes a privatekey storage unit 31, temporarydata storage unit 32,communication unit 33, re-encryptionkey generation unit 34,control unit 35, and randomnumber generation unit 36. - The private
key storage unit 31 is a storage device which stores the private key of the re-encryptionkey generator 30 received from thekey generator 10. - The temporary
data storage unit 32 is a storage device which stores the public key of thedecryption apparatus 50 received from thekey generator 10, and temporary data such as intermediate processing data and processing result data of the re-encryptionkey generation unit 34. - The
communication unit 33 is a communication interface required to communicate withother apparatuses data storage unit 32 to there-encryption apparatus 40 under the control of thecontrol unit 35. - The re-encryption
key generation unit 34 has, for example, the following functions (f34-1) and (f34-2). - (f34-1) A function of generating a re-encryption key based on the private key (the first private key of the first user device) of the re-encryption
key generator 30, which key is read out from the privatekey storage unit 31, the public key (the second public key of the second user device) of thedecryption apparatus 50, which key is read out from the temporarydata storage unit 32, and a random number generated by the random number generation unit 36 (this function does not require any parameter (more specifically, a random number) at the time of encryption). - (f34-2) A function of writing this re-encryption key in the temporary
data storage unit 32. - The
control unit 35 has a function of controlling therespective units 31 to 34 and 36 so as to execute the operations shown inFIG. 4 . - The random
number generation unit 36 has a function of generating and outputting a random number to the re-encryptionkey generation unit 34. - The
re-encryption apparatus 40 includes a re-encryptionkey storage unit 41, temporary data storage unit 42,communication unit 43,re-encryption processing unit 44, re-encryptionparameter generation unit 45, andcontrol unit 47. - The re-encryption
key storage unit 41 is a storage device which stores the re-encryption key received from the re-encryptionkey generator 30. - The temporary data storage unit 42 is a storage device which stores temporary data such as intermediate processing data and processing result data of the
re-encryption processing unit 44. - The
communication unit 43 is a communication interface required to communicate withother apparatuses 10 to 30 and 50, and has, for example, the following functions (f43-1) and (f43-2). - (f43-1) A function of outputting ciphertext data received from the
encryption apparatus 20 to there-encryption processing unit 44. - (f43-2) A function of transmitting re-encrypted text data in the temporary data storage unit 42 to the
decryption apparatus 50 under the control of thecontrol unit 47. - The
re-encryption processing unit 44 has, for example, the following functions (f44-1) and (f44-2). - (f44-1) A function of obtaining re-encrypted text by re-encrypting, without decrypting, ciphertext data received from the
encryption apparatus 20 using the re-encryption key read out from the re-encryptionkey storage unit 41. - (f44-2) A function of writing the obtained re-encrypted text data in the temporary data storage unit 42.
- The
control unit 47 has a function of controlling therespective units 41 to 45 so as to execute an operation for delivering a re-encrypted text verification program (not shown) and operations shown inFIG. 5 . - The
decryption apparatus 50 includes a privatekey storage unit 51, temporarydata storage unit 52,communication unit 53,decryption processing unit 54, andcontrol unit 56. - The private
key storage unit 51 is a storage device which stores the private key of theapparatus 50 received from thekey generator 10. - The temporary
data storage unit 52 is a storage device which stores the public key of theapparatus 50 and that of the re-encryptionkey generator 30, which keys are received from thekey generator 10, and temporary data such as intermediate processing data and processing data of thedecryption processing unit 54. - The
communication unit 53 is a communication interface required to communicate withother apparatuses 10 to 40, and has, for example, the following functions (f53-1) to (f53-3). - (f53-1) A function of writing the private key of the
apparatus 50 received from thekey generator 10 in the privatekey storage unit 51. - (f53-2) A function of writing the public key of the
apparatus 50 and that of the re-encryptionkey generator 30, which keys are received from thekey generator 10, in the temporarydata storage unit 52. - (f53-3) A function of outputting re-encrypted data received from the
re-encryption apparatus 40 to thedecryption processing unit 54. - The
decryption processing unit 54 has, for example, the following functions (f54-1) to (f54-2). - (f54-1) A function of obtaining plaintext data by decrypting re-encrypted text data received from the
re-encryption apparatus 40 based on the private key (the second private key of the second user device) of thedecryption apparatus 50, which key is read out from the privatekey storage unit 51. - (f54-2) A function of writing the obtained plaintext data in the temporary
data storage unit 52. - The
control unit 56 has a function of controlling therespective units 51 to 54 so as to execute operations shown inFIG. 6 . - The operations of the re-encryption system with the aforementioned arrangement will be described below with reference to the sequence charts shown in
FIGS. 2 ,3 ,4 ,5 , and6 . - The following operations will be described taking, as an example, a case in which they are executed in an order of (1) key setup processing, (2) encryption processing, (3) re-encryption key generation processing, (4) re-encryption processing, and (5) decryption processing. However, the following operations need not always be executed in the aforementioned order. For example, the re-encryption key generation may be executed before the encryption processing. Also, ciphertext data may be decrypted without executing the re-encryption processing.
- (1) The key setup processing is executed by the
key generator 10, as shown inFIG. 2 and following steps ST1 to ST12. - Initially, the public
parameter generation unit 13 of thekey generator 10 generates or externally acquires public parameters (p, λ, G, GT, g, g1, g2, u, v, Sig(Ĝ,Ŝ,V̂)) (step ST1). More specifically, the pubicparameter generation unit 13 generates, based on a security parameter λ stored in advance in the keyparameter storage unit 11, bilinear map groups (G, GT) which satisfy the prime order p > 2λ, members g, g1, g2, u, and v of G, and a one-time signature algorithm Sig(Ĝ,Ŝ,V̂) which satisfies strong unforgeability. Note that Zp* is a set of integers (= (Z/pZ)*) which are coprime to Zp and p, and may also be called a multiplicative group Zp* for the prime p. Zp is a set (= (Z/pZ)) of integers not less than 0 and less than p. The term "member" is a term having a mathematical meaning, is also called an element, and indicates each individual one in a set including a plurality of "ones". Also, in the one-time signature algorithm Sig(Ĝ,Ŝ,V̂) (to be also referred to as "Sig" hereinafter), G means a function of generating a one-time key pair (ssk, svk), S means a function of generating a signature σ for a message M, and V means a function of verifying authenticity of the signature σ. - As for details of the one-time signature, please refer to [A. Menezes, P. van Oorschot, S. Vanstone, "Handbook of Applied Cryptography", CRC Press, (1996) pp. 462 - 471, (1996)].
- The bilinear map (to be expressed by "e") is a map e: G x G → GT, and satisfies the following three properties.
- 1. For arbitrary (g, h) ∈ G × G and a, b ∈ Z, e(ga, hb) = e(g, h)ab holds where Z is a set of integers.
- 2. For arbitrary (g, h) ∈ G × G, e(g, h) is calculable.
- 3. When g, h ≠ 1G, e(g, h) ≠ 1GT always holds where 1G is a unit member of G, and 1GT is a unit member of GT.
- The bilinear map groups (expressed by G and GT) are groups of prime orders p including the bilinear map e: G × G → GT. If g1 = gα and g2 = gβ for the members g, g1, and g2 of G, the aforementioned definition means that the following equation holds:
- Note that the plurality of members g, g1, and g2 of G are a plurality of predetermined system fixed values. The plurality of system fixed values are not limited to the three members of the bilinear map group G, and a plurality of members (for example, two or four or more members) of G can be used as needed. The term "system fixed value" may be read as "fixed value", "member", or "system parameter". The plurality of system fixed values are a plurality of members of a bilinear map group as a group of prime orders including a bilinear map.
- This specification adopts a notation which assumes both G and GT as multiplicative groups. However, the present invention is not limited to this, and G and GT can be expressed by a notation which regards them as additive groups. That is, for example, G may be expressed as an additive group, and GT may be expressed as a multiplicative group. As the bilinear map, a map e: G1 × G2 → GT for bilinear map groups G1, G2, and GT (G1 and G2 are different groups) may be used. The same applies to other embodiments.
- Subsequently, the public
parameter generation unit 13 writes the generated public parameters in the temporarydata storage unit 12. Thekey generator 10 publishes the public parameters (p, λ, G, GT, g, g1, g2, u, v, Sig) in the temporary data storage unit 12 (step ST2). Note that when the public parameters have already been published before execution of step ST1, these public parameters may be written in the temporarydata storage unit 12, and steps ST1 and ST2 may be skipped. - Letting i be identification information of the re-encryption
key generator 30, the public key/privatekey generation unit 14 generates a private key xi, yi, zi ∈ zp*, and generates a public key pki = (Xi, Y1i, Y2i, Zi, Z1i) (for Xi = gxi , Y1i = g1 yi , Y2i = g2 yi , Zi = gzi , and Z1i = g1 zi ) of the re-encryptionkey generator 30 using this private key ski = (xi, yi, zi) (step ST7). - Subsequently, the public key/private
key generation unit 14 writes the generated public key/private key pair in the temporarydata storage unit 12. Thecommunication unit 15 transmits the private key ski in the temporarydata storage unit 12 to the re-encryptionkey generator 30 under the control of the control unit 16 (step ST8). Thekey generator 10 publishes the public key pki of the re-encryptionkey generator 30 in the temporary data storage unit 12 (step ST9). - Likewise, letting j be identification information of the
decryption apparatus 50, the public key/privatekey generation unit 14 generates a private key skj = (xj, yj, zj) of thedecryption apparatus 50, and generates a public key pkj = (Xj, Y1j, Y2j, Zj, Z1j) (for Xj = gxj , Y1j = g1 yj, Y2j = g2 yj, zj = gzj, and Z1j = g1 zj) of the re-encryptionkey generator 30 using this private key skj = (xj, yj, zj) (step ST10). - Then, the public key/private
key generation unit 14 writes the generated public key/private key pair in the temporarydata storage unit 12. Thecommunication unit 15 transmits the private key skj in the temporarydata storage unit 12 to thedecryption apparatus 50 under the control of the control unit 16 (step ST11). Thekey generator 10 publishes the public key pkj of thedecryption apparatus 50 in the temporary data storage unit 12 (step ST12). Also, if required, the same processes as those in steps ST10 to ST12 may be executed for a private key skh and public key pkh of theencryption apparatus 20, the private key skh may be transmitted to theencryption apparatus 20, and the public key pkh may be published. - With the above processes, the key setup processing is complete. After that, the
apparatuses - (2) The encryption processing is executed by the
encryption apparatus 20, as shown inFIG. 3 and following steps ST21 to ST24. - That is, the encryption
parameter generation unit 23 of theencryption apparatus 20 generates a key pair (ssk, svk) = Ĝ(λ) of a signature key ssk and verification key svk in the one-time signature using the security parameter λ and the key pair generation function G in the public parameters (step ST21), and sets the verification key svk in encrypted data C1 (C1 = svk). - Also, the encryption
parameter generation unit 23 generates a random number r ∈ zp*, and outputs it to the ciphertext generation unit 24. -
- After completion of step ST22, the ciphertext generation unit 24 generates, for the encrypted data C3 and C4, a one-time signature σ by means of the signature generation function S in the public parameters and the signature key ssk generated in step ST21 (step ST23). The signature σ is described by:
- After that, the ciphertext generation unit 24 generates ciphertext data Ci = (C1, C2X, C2Y, C2Z, C2Z1, C3, C4, σ) including all the encrypted data C1 to C4 and the one-time signature σ, and writes the obtained ciphertext data in the temporary
data storage unit 21. Note that the ciphertext data Ci = (C1, C2X, C2Y, C2Z, C2Z1, C3, C4, σ) may be modified to ciphertext data Ci = (C2X, C2Y, C2Z, C2Z1, C3) by omitting verification data (C1, C4, σ) which is not used in decryption when verification is skipped. In this case, the processing for generating the verification data (C1, C4, σ) is also skipped. - In either case, the
communication unit 22 transmits the ciphertext data Ci in the temporarydata storage unit 21 to there-encryption apparatus 40 under the control of the control unit 25 (step ST24). - With the above processes, the encryption processing is complete.
- Note that in this embodiment, verification may be skipped and generation of the verification data may be skipped, as described above (or as will be described later). This applies to the following embodiments and modifications.
- (3) The re-encryption key generation processing is executed by the re-encryption
key generator 30, as shown inFIG. 4 and following steps ST31 to ST33. - That is, the
communication unit 33 of the re-encryptionkey generator 30 acquires the public key pkj of thedecryption apparatus 50 published from thekey generator 10 and writes it in the temporarydata storage unit 32 under the control of the control unit 35 (step ST31). Also, in step ST5 described above, thecommunication unit 33 received the private key ski of the re-encryptionkey generator 30 from thekey generator 10 and wrote it in the privatekey storage unit 31. - The random
number generation unit 36 generates a random number θ ∈ zp*, and outputs it to the re-encryptionkey generation unit 34. - The re-encryption
key generation unit 34 generates a re-encryption key Rij based on this random number θ, the private key ski of the re-encryptionkey generator 30 in the privatekey storage unit 31, and the public key pkj of thedecryption apparatus 50 in the temporary data storage unit 32 (step ST32). The re-encryption key Rij is described by: - After that, the re-encryption
key generation unit 34 writes the generated re-encryption key Rij in the temporarydata storage unit 32. Thecommunication unit 33 transmits the re-encryption key Rij in the temporarydata storage unit 32 to there-encryption apparatus 40 under the control of the control unit 35 (step ST33). - With the above processes, the re-encryption key generation processing is complete.
- (4) The re-encryption processing is executed by the
re-encryption apparatus 40, as shown inFIG. 5 and following steps ST41 to ST43. - The
communication unit 43 of there-encryption apparatus 40 writes the ciphertext data Ci transmitted in step ST24 and the re-encryption key Rij transmitted in step ST33 in the temporary data storage unit 42. -
- Note that when all five verification formulas hold, the verification has succeeded; when at least one verification formula does not hold, the verification has failed.
- If the verification has succeeded, the re-encryption
parameter generation unit 45 generates three random numbers s, t, and k ∈ zp*, and outputs them to there-encryption processing unit 44. - The
re-encryption processing unit 44 generates re-encrypted data C2X', C2X", C2Y', C2Y", C2Z', C2Z", C2Z1', C2Z1", C2"', C5X, C5Y, and C5Z using these random numbers s, t, and k, the ciphertext data Ci in the temporary data storage unit 42, and the re-encryption key Rij in the temporary data storage unit 42 (step ST42). These re-encrypted data are respectively described by: - After completion of step ST42, the
re-encryption processing unit 44 replaces the encrypted data C2X, C2Y, C2Z, and C2Z1 in the ciphertext data Ci by all the encrypted data re-encrypted data C2X' to C5Z to generate re-encrypted text data Cj = (C1, C2X', C2X", C2Y', C2Y", C2Z', C2X", C2Z1', C2Z1", C2"', C5X, C5Y, C5Z, C3, C4, σ), and writes the obtained re-encrypted text data Cj in the temporary data storage unit 42. Note that the re-encrypted text data Cj = (C1, C2X', C2X", C2Y', C2Y", C2Z', C2X", C2Z1', C2Z1", C2"', C5X, C5Y, C5Z, C3, C4, σ) may be modified to Cj = (C2X", C2Y", C2X", C2Z1", C5X, C5Y, C5Z, C3, C4, σ) by omitting verification data (C1, C2X', C2Y', C2Z', C2Z1', C2"', C4, σ) which is not used in decryption when the verification is skipped. In this case, the processing for generating the verification data (C2X', C2Y', C2Z', C2Z1', C2"') is also skipped. - In either case, the
communication unit 43 transmits the re-encrypted text data Cj in the temporary data storage unit 42 to thedecryption apparatus 50 under the control of the control unit 47 (step ST43). - With the above processes, the re-encryption processing is complete.
- (5) The decryption processing is executed by the
decryption apparatus 50, as shown inFIG. 6 and following steps ST51 and ST52. - That is, the
communication unit 53 of thedecryption apparatus 50 receives the re-encrypted text data Cj transmitted in step ST43, and writes it in the temporarydata storage unit 52. -
- If all seven verification formulas hold, the verification has succeeded; if at least one verification formula does not hold, the verification has failed.
-
-
- Note that the
decryption processing unit 54 may skip the verification processing of step ST51, and may execute the decryption processing of step ST52. Also, when the re-encrypted text data Cj does not include any verification data, thedecryption processing unit 54 skips the verification processing of step ST51 and executes the decryption processing of step ST52. Furthermore, m may be a key in place of the message itself. For example, as for a symmetric key "key" in the symmetric key cryptosystem, m = key may be set to replace m by "key". In this case, ciphertext obtained by encrypting a message using the symmetric key "key" may be appended to the ciphertext data or re-encrypted text data. The same applies to the following embodiments and modifications. - Note that the order of processes may be changed as needed in this embodiment. For example, the order of the decryption processing and ciphertext verification processing may be changed. Likewise, since the re-encryption key generation processing does not require any parameter (more specifically, a random number) used upon execution of the encryption processing, the re-encryption key generation processing may be executed before the encryption processing.
- As described above, according to this embodiment, since the re-encryption key Rij is generated based on the random number θ, even when the server and users collude, the decryption authority can be prevented from being re-transferred without any permission of a transfer source. In this manner, since extremely high reliability need not be required for the server, a file sharing system which can be used by the users more securely can be provided.
- In the example described in the first embodiment, the
encryption apparatus 20 generates ciphertext data, there-encryption apparatus 40 re-encrypts the ciphertext data to generate re-encrypted text data, and thedecryption apparatus 50 decrypts the re-encrypted text data. However, the first embodiment may be modified to a mode in which ciphertext data is decrypted without re-encryption. In this case, only the key setup processing, encryption processing, and decryption processing can be executed. The key setup processing in this modification is the same as that in the first embodiment. The encryption processing and decryption processing in this modification will be described below. - The difference between the encryption processing of this modification and that of the first embodiment is only in the final step. In order to give the following description while using the aforementioned symbols, let i be the identification informant of the
decryption apparatus 50 for the sake of convenience. In this case, thecommunication unit 22 of theencryption apparatus 20 transmits ciphertext data Ci in the temporarydata storage unit 21 to thedecryption apparatus 50 under the control of the control unit 25 (step ST24'). - The
decryption apparatus 50 verifies the ciphertext data Ci generated by theencryption apparatus 20 in the same manner as in step ST41. If the verification has succeeded, thedecryption apparatus 50 decrypts the ciphertext data Ci using the private key ski to obtain a message m. This decryption is described by: -
- In addition to
modification 1, as will be described below, the first embodiment may be modified to a mode in which ciphertext data is decrypted without re-encryption. In this case as well, only the key setup processing, encryption processing, and decryption processing can be executed. The key setup processing and decryption processing of this modification are the same as those in the first embodiment. The encryption processing and decryption processing of this modification will be described below. Note that j refers to identification information of thedecryption apparatus 50 in this modification. - The encryption
parameter generation unit 23 of theencryption apparatus 20 generates (ssk, svk) (step ST21') in the same manner as in step ST21 and sets the verification key svk in ciphertext data C1 (C1 = svk). - Also, the encryption
parameter generation unit 23 generates five random numbers; r, s, t, k, and θ ∈ zp*, and outputs them to the ciphertext generation unit 24. - The ciphertext generation unit 24 generates encrypted data C2X', C2X", C2Y', C2Y", C2Z', C2Z", C2Z1', C2Z1", C2"', C5X, C5Y, C5Z, C3, and C4 with respect to a message m ∈ GT as plaintext data using these random numbers r, s, t, k, and θ, and the public key pkj of the decryption apparatus 50 (step ST22'). These encrypted data are respectively given by:
- After completion of step ST22', the ciphertext generation unit 24 generates a one-time signature σ in the same manner as in step ST23.
- After that, the ciphertext generation unit 24 generates ciphertext data Cj = (C1, C2X', C2X", C2Y', C2Y", C2Z', C2Z", C2Z1', C2Z1", C2"', C5X, C5Y, C5Z, C3, C4, σ) including all the encrypted data C1 to C4 and the one-time signature σ, and writes the obtained ciphertext data in the temporary
data storage unit 21. - The
communication unit 22 transmits the ciphertext data Cj in the temporarydata storage unit 21 to thedecryption apparatus 50 under the control of thecontrol unit 25. - The
decryption apparatus 50 verifies the ciphertext data Cj generated by theencryption apparatus 20 in the same manner as in step ST51. If the verification has succeeded, thedecryption apparatus 50 decrypts the ciphertext data Cj using the private key skj to obtain a message m. This decryption is described by: -
- In the example described in the first embodiment, the public parameters include the three members g, g1, and g2 of the system fixed values. However, the present invention is not limited to this. For example, the member g2 may not be generated, and the public parameters may not include the member g2. In this case, in the first embodiment, g2 = g may be set to replace g2 by g. The same applies to the following embodiments and modifications.
- In the example described in the first embodiment, the public parameters include the three members g, g1, and g2 of the system fixed values. However, the present invention is not limited to this. For example, the public parameters may include four or more members of the system fixed values. For example, when the public parameters include four members g, g1, g2, and g3, g2 = g2g3 may be set to replace g2 by g2g3 in the first embodiment. Also, for example, when the public parameters include five members g, g1, 92, g3, and g4, g1 = g1g3 and g2 = g2g4 may be set to respectively replace g1 by g1g3 and g2 by g2g4 in the first embodiment. The same applies to the following embodiments and modifications.
- This embodiment will explain an example in which a re-encryption key is updated every certain period. As a parameter which expresses a period, a time parameter L is used. Of the key setup processing, encryption processing, re-encryption key generation processing, re-encryption processing, and decryption processing, the encryption processing, re-encryption key generation processing, and re-encryption processing use the time parameter. The time parameter is used as follows. For example, when the encryption processing is executed in a certain period t1, the encryption processing to be described later is executed to have L = t1; when the encryption processing is executed in the next period t2, the encryption processing to be described later is executed to have L = t2. The key setup processing, encryption processing, re-encryption key generation processing, re-encryption processing, and decryption processing of this embodiment will be described below. Note that parts common to the first embodiment described above will be described using the same reference numerals and a description thereof will not be repeated.
- Public parameters are the same as those in the first embodiment. Letting i be identification information of a re-encryption
key generator 30, a public key/privatekey generation unit 14 generates a private key xi, yi, zi, wi ∈ Zp* of the re-encryptionkey generator 30, and generates a public key pki = (Xi, Y1i, Y2i, Zi, Z1i, Wi, W1i) (for Xi = gxi , Y1i = g1 yi , Y2i = g2 yi , Zi = gzi , Z1i = g1 zi , Wi = gwi , and W1i = g1 wi ) of the re-encryptionkey generator 30 using this private key ski = (xi, yi, zi, wi) (step ST7). - Likewise, letting j be identification information of a
decryption apparatus 50, the public key/privatekey generation unit 14 generates a private key skj = (xj, yj, zj, wj) of thedecryption apparatus 50, and generates a public key pkj = (Xj, Y1j, Y2j, Zj, Z1j, Wj, W1j) (for Xj = gxj , Y1j = g1 yj , Y2j = g2 yj , Zj = gzj , Z1j = g1 zj , Wj = gwj , and W1j = g1 wj ) of thedecryption apparatus 50 using this private key skj (step ST10). - As in the first embodiment, an encryption
parameter generation unit 23 of anencryption apparatus 20 generates (ssk, svk) (step ST21), and sets a verification key svk in ciphertext data C1 (C1 = svk). - Also, the encryption
parameter generation unit 23 generates a random number r ∈ Zp*, and outputs it to a ciphertext generation unit 24. - The ciphertext generation unit 24 generates encrypted data C2X, C2Y, C2Z, C2Z1, C2F, C3, and C4 with respect to a message m ∈ GT as plaintext data using this random number r, the public key pki of the re-encryption
key generator 30, and the time parameter L (step ST22). These encrypted data are respectively given by: - After completion of step ST22, the ciphertext generation unit 24 generates, for the time parameter L and the encrypted data C3 and C4, a one-time signature σ by means of a signature generation function S in the public parameters and the signature key ssk generated in step ST21 (step ST23). The signature σ is described by:
- After that, the ciphertext generation unit 24 generates ciphertext data Ci = (L, C1, C2X, C2Y, C2Z, C2Z1, C2F, C3, C4, σ) including the time parameter L, all the encrypted data C1 to C4, and the one-time signature σ, and writes the obtained ciphertext data in a temporary
data storage unit 21. - A random
number generation unit 36 generates three random numbers; θ, δx, and δy ∈ Zp*, and outputs them to a re-encryptionkey generation unit 34. - The re-encryption
key generation unit 34 generates a re-encryption key RijL using these random numbers θ, δx, and δy, the private key ski of the re-encryptionkey generator 30 in a privatekey storage unit 31, and the public key pkj of thedecryption apparatus 50 in a temporary data storage unit 32 (step ST32). The re-encryption key RijL is described by: -
- Note that when all the five verification formulas hold, the verification has succeeded; when at least one verification formula does not hold, the verification has failed.
- If the verification has succeeded, a re-encryption
parameter generation unit 45 generates four random numbers; s, t, k, and h ∈ Zp*, and outputs them to are-encryption processing unit 44. - The
re-encryption processing unit 44 generates re-encrypted data C2X', C2X", C2Y', C2Y", C2Z', C2Z", C2Z1', C2Z1", C2F', C2F", C5X, C5Y, C5Z, C5FX, and C5FY using these random numbers s, t, k, and h, the ciphertext data Ci in the temporary data storage unit 42, the re-encryption key RijL in the temporary data storage unit 42, and the time parameter L (step ST42). These re-encrypted data are respectively described by: - After completion of step ST42, the
re-encryption processing unit 44 replaces the encrypted data C2X, C2Y, C2Z, C2Z1, C2F in the ciphertext data Ci by all the encrypted data re-encrypted data C2X' to C5FY to generate re-encrypted text data Cj = (C1, C2X', C2X", C2Y', C2Y", C2Z', C2X", C2Z1', C2Z1", C2F', C2F", C5X, C5Y, C5Z, C5FX, C5FY, C3, C4, σ), and writes the obtained re-encrypted text data Cj in the temporary data storage unit 42. -
- If all the eight verification formulas hold, the verification has succeeded; if at least one verification formula does not hold, the verification has failed.
-
-
- Note that the order of processes may be changed as needed in this embodiment. For example, the order of the decryption processing and ciphertext verification processing may be changed. Likewise, the re-encryption key generation processing may be executed before the encryption processing.
- As described above, according to this embodiment, since the re-encryption key RijL is generated based on the random numbers θ, δx, and δy, and the time parameter L, whether or not to transfer the decryption authority can be decided for each period, thus allowing flexible access control, in addition to the effects of the first embodiment. Thus, even after the decryption authority about ciphertext for a user A is transferred to a user B in a certain period, the decryption authority about ciphertext for the user A is not given to the user B in the next period, that is, the decryption authority of the user B (about ciphertext for the user A) can be invalidated, thus providing a more convenient file sharing system.
- In the example described in the second embodiment, the
encryption apparatus 20 generates ciphertext data, are-encryption apparatus 40 re-encrypts the ciphertext data to generate re-encrypted text data, and thedecryption apparatus 50 decrypts the re-encrypted text data. However, the second embodiment may be modified to a mode in which ciphertext data is decrypted without re-encryption. In this case, only the key setup processing, encryption processing, and decryption processing can be executed. The key setup processing in this modification is the same as that in the second embodiment. The encryption processing and decryption processing in this modification will be described below. - The difference between the encryption processing of this modification and that of the second embodiment is only in the final step. In order to give the following description while using the aforementioned symbols, let i be the identification informant of the
decryption apparatus 50 for the sake of convenience. In this case, acommunication unit 22 of theencryption apparatus 20 transmits ciphertext data Ci in the temporarydata storage unit 21 to thedecryption apparatus 50 under the control of a control unit 25 (step ST24'). - The
decryption apparatus 50 verifies the ciphertext data Ci generated by theencryption apparatus 20 in the same manner as in step ST41. If the verification has succeeded, thedecryption apparatus 50 decrypts the ciphertext data Ci using the private key ski to obtain a message m. This decryption is described by: -
- In addition to modification 5, as will be described below, the first embodiment may be modified to an aspect in which ciphertext data is decrypted without re-encryption. In this case as well, only the key setup processing, encryption processing, and decryption processing can be executed. The key setup processing and decryption processing of this modification are the same as those in the second embodiment. The encryption processing and decryption processing of this modification will be described below. Note that j refers to identification information of the
decryption apparatus 50 in this modification. - The encryption
parameter generation unit 23 of theencryption apparatus 20 generates (ssk, svk) (step ST21') in the same manner as in step ST21 and sets the verification key svk in ciphertext data C1 (C1 = svk). - Also, the encryption
parameter generation unit 23 generates eight random numbers; r, s, t, k, h, θ, δx, and δy ∈ Zp*, and outputs them to the ciphertext generation unit 24. - The ciphertext generation unit 24 generates encrypted data C2X', C2X", C2Y', C2Y", C2Z', C2Z", C2Z1', C2Z1", C2F', C2F", C5X, C5Y, C5Z, C5FX, C5FY, C3, and C4 with respect to a message m ∈ GT as plaintext data using these random numbers r, s, t, k, h, θ, δx, and δy, the public key pkj of the
decryption apparatus 50, and the time parameter L (step ST22'). These encrypted data are respectively given by: - After completion of step ST22', the ciphertext generation unit 24 generates a one-time signature σ in the same manner as in step ST23.
- After that, the ciphertext generation unit 24 generates ciphertext data Cj = (L, C2X', C2X", C2Y', C2Y", C2Z', C2Z", C2Z1', C2Z1", C2F', C2F", C5X, C5Y, C5Z, C5FX, C5FY, C3, C4, σ) including the time parameter L, all the encrypted data C1 to C4 and the one-time signature σ, and writes the obtained ciphertext data in the temporary
data storage unit 21. - The
communication unit 22 transmits the ciphertext data Cj in the temporarydata storage unit 21 to thedecryption apparatus 50 under the control of thecontrol unit 25. - The
decryption apparatus 50 verifies the ciphertext data Cj generated by theencryption apparatus 20 in the same manner as in step ST51. If the verification has succeeded, thedecryption apparatus 50 decrypts the ciphertext data Cj using the private key skj to obtain a message m. This decryption is described by: -
- According to at least one of the aforementioned embodiments, since a re-encryption key is generated based on a random number, even when the server and users collude, the decryption authority can be prevented from being re-transferred without any permission of a transfer source.
- The method described in each embodiment can also be stored in a storage medium such as a magnetic disk (floppy™ disk, hard disk, or the like), an optical disk (CD-ROM, DVD, or the like), a magneto-optical disk (MO), or a semiconductor memory as a program which can be executed by a computer and distributed.
- As the storage medium, any configuration which is a computer-readable storage medium in which a program can be stored may be used regardless of a storage format.
- An OS (operating system) which operates on a computer on the basis of an instruction of a program installed from the storage medium in the computer, database management software, and MW (middleware) such as network software may execute a part of the processes to realize the embodiment.
- Furthermore, the storage medium according to each embodiment includes not only a medium independent of a computer but also a storage medium in which a program transmitted through a LAN, the Internet, or the like is downloaded and stored or temporarily stored.
- The number of storage media is not limited to one. A case in which the process in each embodiment is executed from a plurality of media is included in the storage medium according to the present invention. Any medium configuration may be used.
- A computer according to each embodiment is to execute the processes in each embodiment on the basis of the program stored in a storage medium. The computer may have any configuration such as one apparatus constituted by a personal computer or a system in which a plurality of apparatuses are connected by a network.
- A computer in each embodiment includes not only a personal computer but also an arithmetic processing apparatus, a microcomputer, or the like included in an information processing apparatus. The computer is a generic name of an apparatus and a device which can realize the functions of the present invention by a program.
- While certain embodiments have been described, these embodiments have been presented by way of example only, and are not intended to limit the scope of the inventions. Indeed, the novel embodiments described herein may be embodied in a variety of other forms; furthermore, various omissions, substitutions and changes in the form of the embodiments described herein may be made without departing from the spirit of the inventions. The accompanying claims and their equivalents are intended to cover such forms or modifications as would fall within the scope and spirit of the inventions.
Claims (12)
- A re-encryption key generator (30), which generates a re-encryption key required to obtain re-encrypted text data, which is configured to be decrypted by means of a second private key of a second user device, by re-encrypting, without decrypting, ciphertext data obtained by encrypting plaintext data by means of a first public key of a first user device, the generator characterized by comprising:first storage means (31) for storing a first private key corresponding to the first public key;second storage means (32) for storing a second public key corresponding to the second private key;first random number generation means (36) for generating a first random number; andre-encryption key generation means (34) for generating the re-encryption key based on the first private key, the second public key, and the first random number.
- The re-encryption key generator of claim 1, characterized in that the re-encryption key generation means (34) generates the re-encryption key based on the first private key, the second public key, and the first random number independently of ciphertext data before re-encryption.
- The re-encryption key generator of claim 1, characterized in that the first public key is generated based on the first private key and a plurality of system fixed values, and
the second public key is generated based on the second private key and the plurality of system fixed values. - The re-encryption key generator of claim 2, characterized in that when the first private key is represented by ski = (xi, yi, zi), the second private key is represented by skj = (xj, yj, zj), the first random number is represented by θ, the plurality of system fixed value are represented by g, g1, and g2 (for g, g1, and g2 ∈ G if bilinear map groups as groups of prime orders p including a bilinear map e: G x G → G1 are represented by G and GT), letting β be a power index related to the respective system fixed values (for g2 = gβ), and Rij be the re-encryption key, the re-encryption key Rij is described by:
when the first public key is represented by pki, the first public key pki is described by:
when the second public key is represented by pkj, the first public key pkj is described by:
when the plaintext data is represented by m (for m ∈ GT), a second random number is represented by r, and the ciphertext data is expressed by Ci (the bilinear map e: G x G → GT is expressed by e(,)), the ciphertext data Ci is described by:
when the re-encrypted text data is represented by Cj (third, fourth, and fifth random numbers are represented by s, t, and k), the re-encrypted text data Cj is described by:
a relationship among the plaintext data m, the re-encrypted text data Cj, and the second private key skj is expressed by: - A re-encryption apparatus (40) configured to communicate with a re-encryption key generator (30), which generates a re-encryption key required to obtain re-encrypted text data, which is configured to be decrypted by means of a second private key of a second user device, by re-encrypting, without decrypting, ciphertext data obtained by encrypting plaintext data by means of a first public key of a first user device, the apparatus characterized by comprising:storage means (41) for storing the re-encryption key received from the re-encryption key generator;re-encryption means (44) for obtaining the re-encrypted text data by re-encrypting, without decrypting, the ciphertext data received from the first user device by means of the re-encryption key in the storage means; andmeans (43) for transmitting the obtained re-encrypted text data to the second user device,wherein the re-encryption key is generated based on a first private key corresponding to the first public key, a second public key corresponding to the second private key, and a first random number generated by the re-encryption key generator.
- The re-encryption apparatus of claim 5, characterized in that the re-encryption key is generated independently of ciphertext data before re-encryption.
- A program which is executed by a processor of a re-encryption key generator (30), which generates a re-encryption key required to obtain re-encrypted text data, which is configured to be decrypted by means of a second private key of a second user device, by re-encrypting, without decrypting, ciphertext data obtained by encrypting plaintext data by means of a first public key of a first user device, and which is stored in a non-transitory computer-readable storage medium (M3), the program characterized by comprising:a first program code (33) for controlling the processor to execute processing for writing a first private key corresponding to the first public key in first storage means (31) of the re-encryption key generator;a second program code (ST31) for controlling the processor to execute processing for writing a second public key corresponding to the second private key in second storage means (32) of the re-encryption key generator;a third program code (36) for controlling the processor to execute processing for generating a first random number; anda fourth program code (32) for controlling the processor to execute processing for generating the re-encryption key based on the first private key, the second public key, and the first random number.
- The program of claim 7, characterized in that the processing for generating the re-encryption key is executed by the processor independently of ciphertext data before re-encryption.
- A program which is executed by a processor of a re-encryption apparatus (40) configured to communicate with a re-encryption key generator (30), which generates a re-encryption key required to obtain re-encrypted text data, which is configured to be decrypted by means of a second private key of a second user device, by re-encrypting, without decrypting, ciphertext data obtained by encrypting plaintext data by means of a first public key of a first user device, and which is stored in a non-transitory computer-readable storage medium (M4), the program characterized by comprising:a first program code (43) for controlling the processor to execute processing for writing the re-encryption key received from the re-encryption key generator in storage means (41) of the re-encryption apparatus;a second program code (44) for controlling the processor to execute processing for obtaining the re-encrypted text data by re-encrypting, without decrypting, the ciphertext data received from the first user device by means of the re-encryption key in the storage means; anda third program code (ST43) for controlling the processor to execute processing for transmitting the obtained re-encrypted text data to the second user device,wherein the re-encryption key is generated based on a first private key corresponding to the first public key, a second public key corresponding to the second private key, and a first random number generated by the re-encryption key generator.
- A program which is executed by a processor of an encryption apparatus (20) configured to communicate with a re-encryption apparatus (40) using a re-encryption key required to obtain re-encrypted text data, which is configured to be decrypted by means of a second private key of a second user device, by re-encrypting, without decrypting, ciphertext data obtained by encrypting plaintext data by means of a first public key of a first user device, and which is stored in a non-transitory computer-readable storage medium (M2), the program characterized by comprising:a first program code (22) for controlling the processor to execute processing for writing the first public key in storage means (21) of the encryption apparatus;a second program code (ST22) for controlling the processor to execute processing for obtaining the ciphertext data by encrypting the plaintext data using the first public key in the storage means; anda third program code (ST24) for controlling the processor to execute processing for transmitting the obtained ciphertext data to the re-encryption apparatus,wherein the re-encryption key is generated based on a first private key corresponding to the first public key, a second public key corresponding to the second private key, and a first random number generated by the re-encryption key generator (30).
- A program which is executed by a decryption apparatus (50), which decrypts re-encrypted text data received from an re-encryption apparatus (40) after the re-encryption apparatus re-encrypts, without decrypting, plaintext data by means of a first public key of a first user device to obtain the re-encrypted text data configured to be decrypted by means of a second private key of a second user device, and which is stored in a non-transitory computer-readable storage medium (M5), the program characterized by comprising:a first program code (53) for controlling the processor to execute processing for writing the second private key in storage means (51) of the decryption apparatus; anda second program code (54) for controlling the processor to execute processing for decrypting the re-encrypted text data received from the re-encryption apparatus based on the second private key in the storage means to obtain the plaintext data,wherein the re-encryption key is generated based on a first private key corresponding to the first public key, a second public key corresponding to the second private key, and a first random number generated by a re-encryption key generator (30) which generates the re-encryption key.
- The program of any one of claims 9 to 11, characterized in that the re-encryption key is generated independently of ciphertext data before re-encryption.
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
JP2011099563 | 2011-04-27 | ||
PCT/JP2012/061256 WO2012147869A1 (en) | 2011-04-27 | 2012-04-26 | Re-encryption key generator, re-encryption device, and program |
Publications (3)
Publication Number | Publication Date |
---|---|
EP2704354A1 true EP2704354A1 (en) | 2014-03-05 |
EP2704354A4 EP2704354A4 (en) | 2015-03-11 |
EP2704354B1 EP2704354B1 (en) | 2021-04-07 |
Family
ID=47072384
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
EP12776090.8A Active EP2704354B1 (en) | 2011-04-27 | 2012-04-26 | Re-encryption key generator, re-encryption apparatus, and program |
Country Status (5)
Country | Link |
---|---|
US (1) | US9246683B2 (en) |
EP (1) | EP2704354B1 (en) |
JP (2) | JP5944893B2 (en) |
SG (1) | SG194762A1 (en) |
WO (1) | WO2012147869A1 (en) |
Cited By (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
WO2016063254A1 (en) * | 2014-10-23 | 2016-04-28 | Pageproof.Com Limited | Encrypted collaboration system and method |
CN106031083A (en) * | 2014-04-09 | 2016-10-12 | 株式会社日立制作所 | Re-encryption method, re-encryption system, and re-encryption device |
EP3425614A4 (en) * | 2016-02-29 | 2019-10-23 | Hitachi, Ltd. | Data processing method and data processing system |
US11316657B2 (en) | 2018-04-06 | 2022-04-26 | Crypto Lab Inc. | User device and electronic device for sharing data based on block chain and homomorphic encryption technology and methods thereof |
Families Citing this family (24)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JP5979141B2 (en) * | 2011-06-10 | 2016-08-24 | 日本電気株式会社 | Encrypted statistical processing system, apparatus, method and program |
KR101301609B1 (en) * | 2012-05-31 | 2013-08-29 | 서울대학교산학협력단 | Apparatus and method for generating secret key, and recording medium storing program for executing method of the same in computer |
WO2014024956A1 (en) * | 2012-08-08 | 2014-02-13 | 株式会社 東芝 | Re-encryption key generation device, re-encryption device, encryption device, decryption device, and program |
US9455828B2 (en) * | 2012-08-30 | 2016-09-27 | Nec Corporation | Re-encryption system, re-encryption method and re-encryption program |
JP5749236B2 (en) * | 2012-09-28 | 2015-07-15 | 株式会社東芝 | Key change management device and key change management method |
JP6017336B2 (en) * | 2013-02-12 | 2016-10-26 | 株式会社東芝 | Data management device and power consumption calculation system |
US10148430B1 (en) * | 2013-04-17 | 2018-12-04 | Amazon Technologies, Inc | Revocable stream ciphers for upgrading encryption in a shared resource environment |
JP6151140B2 (en) | 2013-09-13 | 2017-06-21 | 株式会社日立製作所 | Information encryption / decryption method, information providing system, and program |
EP3057262B1 (en) | 2013-10-09 | 2021-07-28 | Mitsubishi Electric Corporation | Cipher system, encryption device, re-encryption key generation device, re-encryption device, and cipher program |
JP6348004B2 (en) * | 2014-06-30 | 2018-06-27 | Kddi株式会社 | Encrypted data management system, proxy server, encrypted data management method, and computer program |
US9987416B2 (en) * | 2015-01-09 | 2018-06-05 | BioQuiddity Inc. | Sterile assembled liquid medicament dosage control and delivery device |
WO2017141399A1 (en) | 2016-02-18 | 2017-08-24 | 株式会社日立製作所 | Data processing system |
JP2018107625A (en) * | 2016-12-26 | 2018-07-05 | 日本電信電話株式会社 | Data distribution system, data generation device, mediation device, data distribution method, and program |
US20200358603A1 (en) * | 2017-11-20 | 2020-11-12 | Telefonaktiebolaget Lm Ericsson (Publ) | Deployment of Components of a Distributed Application to Runtime Environments |
US11362824B2 (en) * | 2018-05-25 | 2022-06-14 | Intertrust Technologies Corporation | Content management systems and methods using proxy reencryption |
CN109564615B (en) * | 2018-10-31 | 2023-05-02 | 北京算能科技有限公司 | Method, device, equipment and storage medium for loading model data |
WO2020146602A1 (en) * | 2019-01-09 | 2020-07-16 | Visa International Service Association | Method, system, and computer program product for network bound proxy re-encryption and pin translation |
WO2020240630A1 (en) * | 2019-05-24 | 2020-12-03 | 三菱電機株式会社 | Re-encryption device, re-encryption method, re-encryption program and cryptosystem |
WO2020242614A1 (en) | 2019-05-30 | 2020-12-03 | Kim Bong Mann | Quantum safe cryptography and advanced encryption and key exchange (aeke) method for symmetric key encryption/exchange |
CN111859474A (en) * | 2020-06-17 | 2020-10-30 | 天津赢达信科技有限公司 | Browser dynamic password input method and device based on digital envelope |
JP6962629B1 (en) * | 2021-03-23 | 2021-11-05 | Eaglys株式会社 | Data sharing systems, data sharing methods, and data sharing programs |
WO2023004007A1 (en) * | 2021-07-22 | 2023-01-26 | Howard University | Hybrid public-key and private-key cryptographic systems based on iso-rsa encryption scheme |
JP7406777B1 (en) * | 2022-07-29 | 2023-12-28 | パスロジ株式会社 | Network storage that processes encrypted files while keeping the private key hidden on the key terminal |
CN116996276A (en) * | 2023-07-20 | 2023-11-03 | 广州芳禾数据有限公司 | Data sharing method and device based on conditional proxy re-encryption |
Family Cites Families (7)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5940507A (en) | 1997-02-11 | 1999-08-17 | Connected Corporation | Secure file archive through encryption key management |
US6859533B1 (en) | 1999-04-06 | 2005-02-22 | Contentguard Holdings, Inc. | System and method for transferring the right to decode messages in a symmetric encoding scheme |
ES2304929T3 (en) * | 1999-12-21 | 2008-11-01 | Contentguard Holdings, Inc. | METHOD TO TRANSFER THE RIGHTS TO DECODE MONTHLY. |
JP2003005953A (en) * | 2001-06-26 | 2003-01-10 | Sony Corp | Device and method for generating random number and its program |
JP4586163B2 (en) * | 2005-09-09 | 2010-11-24 | 国立大学法人岩手大学 | Encryption system |
US8094810B2 (en) * | 2006-02-03 | 2012-01-10 | Massachusetts Institute Of Technology | Unidirectional proxy re-encryption |
JP5171420B2 (en) * | 2008-06-18 | 2013-03-27 | ルネサスエレクトロニクス株式会社 | Pseudo random number generator |
-
2012
- 2012-04-26 EP EP12776090.8A patent/EP2704354B1/en active Active
- 2012-04-26 WO PCT/JP2012/061256 patent/WO2012147869A1/en active Application Filing
- 2012-04-26 SG SG2013081468A patent/SG194762A1/en unknown
- 2012-04-26 JP JP2013512438A patent/JP5944893B2/en active Active
-
2013
- 2013-10-25 US US14/063,553 patent/US9246683B2/en active Active
-
2014
- 2014-07-01 JP JP2014136166A patent/JP5851558B2/en active Active
Cited By (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN106031083A (en) * | 2014-04-09 | 2016-10-12 | 株式会社日立制作所 | Re-encryption method, re-encryption system, and re-encryption device |
WO2016063254A1 (en) * | 2014-10-23 | 2016-04-28 | Pageproof.Com Limited | Encrypted collaboration system and method |
US10515227B2 (en) | 2014-10-23 | 2019-12-24 | Pageproof.Com Limited | Encrypted collaboration system and method |
EP3425614A4 (en) * | 2016-02-29 | 2019-10-23 | Hitachi, Ltd. | Data processing method and data processing system |
US11316657B2 (en) | 2018-04-06 | 2022-04-26 | Crypto Lab Inc. | User device and electronic device for sharing data based on block chain and homomorphic encryption technology and methods thereof |
Also Published As
Publication number | Publication date |
---|---|
JPWO2012147869A1 (en) | 2014-07-28 |
US9246683B2 (en) | 2016-01-26 |
JP5944893B2 (en) | 2016-07-05 |
JP5851558B2 (en) | 2016-02-03 |
SG194762A1 (en) | 2013-12-30 |
WO2012147869A1 (en) | 2012-11-01 |
JP2014209780A (en) | 2014-11-06 |
US20140050318A1 (en) | 2014-02-20 |
EP2704354B1 (en) | 2021-04-07 |
EP2704354A4 (en) | 2015-03-11 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
EP2704354B1 (en) | Re-encryption key generator, re-encryption apparatus, and program | |
EP2763345B1 (en) | Server device and program | |
US10187207B2 (en) | Re-encryption key generator, re-encryption apparatus, encryption apparatus, decryption apparatus, and storage medium | |
JP5932040B2 (en) | Re-encryption key generation apparatus and program | |
US9698984B2 (en) | Re-encrypted data verification program, re-encryption apparatus and re-encryption system | |
US9813386B2 (en) | Cooperation service providing system and server apparatus | |
CN111371790B (en) | Data encryption sending method based on alliance chain, related method, device and system | |
JP6194886B2 (en) | Encryption statistical processing system, decryption system, key generation device, proxy device, encrypted statistical data generation device, encryption statistical processing method, and encryption statistical processing program | |
US20170310479A1 (en) | Key Replacement Direction Control System and Key Replacement Direction Control Method | |
JP6313074B2 (en) | Data management device, system, data sharing device, and program | |
EP3474486B1 (en) | Terminal device, key distribution management device, server-client system, communication method, and program | |
US20180278417A1 (en) | Apparatus and method for generating key, and apparatus and method for encryption | |
JP2006333193A (en) | Integrated shuffle-justice proving apparatus, proof integrating apparatus, integrated shuffle-justice verifying apparatus, and mixed network system | |
JP5392264B2 (en) | Name encryption device, pseudonymization device, name encryption method, and pseudonymization method |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
PUAI | Public reference made under article 153(3) epc to a published international application that has entered the european phase |
Free format text: ORIGINAL CODE: 0009012 |
|
17P | Request for examination filed |
Effective date: 20131025 |
|
AK | Designated contracting states |
Kind code of ref document: A1 Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR |
|
DAX | Request for extension of the european patent (deleted) | ||
A4 | Supplementary search report drawn up and despatched |
Effective date: 20150206 |
|
RIC1 | Information provided on ipc code assigned before grant |
Ipc: H04L 9/14 20060101ALI20150202BHEP Ipc: H04L 9/30 20060101AFI20150202BHEP Ipc: H04L 9/08 20060101ALI20150202BHEP |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: EXAMINATION IS IN PROGRESS |
|
17Q | First examination report despatched |
Effective date: 20180507 |
|
APBK | Appeal reference recorded |
Free format text: ORIGINAL CODE: EPIDOSNREFNE |
|
APBN | Date of receipt of notice of appeal recorded |
Free format text: ORIGINAL CODE: EPIDOSNNOA2E |
|
APBR | Date of receipt of statement of grounds of appeal recorded |
Free format text: ORIGINAL CODE: EPIDOSNNOA3E |
|
APBV | Interlocutory revision of appeal recorded |
Free format text: ORIGINAL CODE: EPIDOSNIRAPE |
|
GRAP | Despatch of communication of intention to grant a patent |
Free format text: ORIGINAL CODE: EPIDOSNIGR1 |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: GRANT OF PATENT IS INTENDED |
|
INTG | Intention to grant announced |
Effective date: 20201120 |
|
GRAS | Grant fee paid |
Free format text: ORIGINAL CODE: EPIDOSNIGR3 |
|
GRAA | (expected) grant |
Free format text: ORIGINAL CODE: 0009210 |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: THE PATENT HAS BEEN GRANTED |
|
AK | Designated contracting states |
Kind code of ref document: B1 Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR |
|
REG | Reference to a national code |
Ref country code: GB Ref legal event code: FG4D |
|
RAP3 | Party data changed (applicant data changed or rights of an application transferred) |
Owner name: TOSHIBA SOLUTIONS CORPORATION Owner name: KABUSHIKI KAISHA TOSHIBA |
|
REG | Reference to a national code |
Ref country code: AT Ref legal event code: REF Ref document number: 1381093 Country of ref document: AT Kind code of ref document: T Effective date: 20210415 Ref country code: CH Ref legal event code: EP |
|
REG | Reference to a national code |
Ref country code: DE Ref legal event code: R096 Ref document number: 602012075123 Country of ref document: DE |
|
REG | Reference to a national code |
Ref country code: IE Ref legal event code: FG4D |
|
REG | Reference to a national code |
Ref country code: LT Ref legal event code: MG9D |
|
REG | Reference to a national code |
Ref country code: NL Ref legal event code: MP Effective date: 20210407 Ref country code: AT Ref legal event code: MK05 Ref document number: 1381093 Country of ref document: AT Kind code of ref document: T Effective date: 20210407 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: FI Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20210407 Ref country code: LT Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20210407 Ref country code: NL Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20210407 Ref country code: AT Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20210407 Ref country code: BG Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20210707 Ref country code: HR Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20210407 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: GR Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20210708 Ref country code: LV Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20210407 Ref country code: IS Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20210807 Ref country code: SE Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20210407 Ref country code: ES Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20210407 Ref country code: PL Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20210407 Ref country code: PT Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20210809 Ref country code: NO Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20210707 |
|
GBPC | Gb: european patent ceased through non-payment of renewal fee |
Effective date: 20210407 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: LU Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES Effective date: 20210426 |
|
REG | Reference to a national code |
Ref country code: DE Ref legal event code: R097 Ref document number: 602012075123 Country of ref document: DE |
|
REG | Reference to a national code |
Ref country code: BE Ref legal event code: MM Effective date: 20210430 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: CH Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES Effective date: 20210430 Ref country code: LI Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES Effective date: 20210430 Ref country code: MC Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20210407 Ref country code: RO Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20210407 Ref country code: GB Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES Effective date: 20210407 Ref country code: EE Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20210407 Ref country code: CZ Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20210407 Ref country code: DK Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20210407 Ref country code: SM Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20210407 Ref country code: SK Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20210407 |
|
PLBE | No opposition filed within time limit |
Free format text: ORIGINAL CODE: 0009261 |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: NO OPPOSITION FILED WITHIN TIME LIMIT |
|
26N | No opposition filed |
Effective date: 20220110 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: IE Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES Effective date: 20210426 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: IS Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20210807 Ref country code: AL Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20210407 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: IT Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20210407 Ref country code: BE Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES Effective date: 20210430 |
|
PGFP | Annual fee paid to national office [announced via postgrant information from national office to epo] |
Ref country code: FR Payment date: 20230309 Year of fee payment: 12 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: RS Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20210407 Ref country code: HU Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT; INVALID AB INITIO Effective date: 20120426 Ref country code: CY Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20210407 |
|
PGFP | Annual fee paid to national office [announced via postgrant information from national office to epo] |
Ref country code: GB Payment date: 20230302 Year of fee payment: 12 |
|
PGFP | Annual fee paid to national office [announced via postgrant information from national office to epo] |
Ref country code: DE Payment date: 20230228 Year of fee payment: 12 |